@sixb/core 0.1.6 → 0.1.8

package/src/execution/authorization.ts

@@ -1,11 +1,24 @@
+import { isDeepStrictEqual } from "node:util"
+import { agentServiceAccountId } from "../agents/identity"
 import type { Principal } from "../auth"
-import { emptyGrantSets, GRANT_KIND_KEYS } from "../authorization/grant-kinds"
+import { TARGETED_GRANT_KIND_KEYS, type TargetedGrantKind } from "../authorization/grant-kinds"
 import type { AuthorizationContext, GrantIndex } from "../authorization/types"
 import { createSixbError } from "../errors/internal"
+import type { ObjectRef } from "../ontology"
+import {
+  type ObjectReadExecutionLimits,
+  snapshotObjectReadExecutionLimits,
+} from "../storage/objects/execution-limits"
+import { compileSelectedObjectReadScope } from "../storage/objects/read-scope"
+import type {
+  CompiledSelectedObjectReadScope,
+  SelectedObjectReadScope,
+} from "../storage/objects/types"
 import {
   type AuthorizablePrincipal,
   type AuthorizationRef,
   createRuntimeAuthorizationCapability,
+  type ExecutionContext,
   type ExecutionScope,
   isRuntimeAuthorizationCapability,
   type KernelOperation,
@@ -20,16 +33,33 @@ export type ResolvedRuntimeAuthorization =
       readonly projectId: string
       readonly context: AuthorizationContext
       readonly ref: Extract<AuthorizationRef, { readonly type: "principal" }>
-      /** Process-local binding used by provider façades that explicitly support agent runs. */
-      readonly executionBinding?: AgentExecutionBinding
     }
   | {
       readonly type: "unrestricted"
       readonly projectId: string
-      readonly ref: Exclude<AuthorizationRef, { readonly type: "principal" }>
+      readonly ref: Exclude<AuthorizationRef, { readonly type: "principal" | "delegated" }>
+    }
+  | {
+      readonly type: "delegated"
+      readonly projectId: string
+      readonly objectRead: DelegatedObjectReadAuthorization
+      readonly actionApply: readonly DelegatedActionApplyTarget[]
+      readonly delegation?: Extract<AuthorizationRef, { readonly type: "delegated" }>["delegation"]
     }
   | { readonly type: "denied" }
 
+/** Immutable process-local object-read authority. It has no durable representation. */
+export interface DelegatedObjectReadAuthorization {
+  readonly scope: CompiledSelectedObjectReadScope
+  readonly limits: ObjectReadExecutionLimits
+}
+
+/** One exact object-bound Action target carried by process-local delegated authority. */
+export interface DelegatedActionApplyTarget {
+  readonly actionId: string
+  readonly subject: ObjectRef
+}
+
 type RegisteredRuntimeAuthorization = Exclude<
   ResolvedRuntimeAuthorization,
   { readonly type: "denied" }
@@ -39,53 +69,70 @@ type PrincipalAuthorizationContext = Omit<AuthorizationContext, "principal"> & {
   readonly principal: AuthorizablePrincipal
 }
 
-interface AgentExecutionBinding {
-  readonly type: "agent"
-  readonly executionId: string
-  readonly agentId: string
-  readonly runId: string
+interface RuntimeAuthorizationRegistration {
+  readonly resolved: RegisteredRuntimeAuthorization
+  readonly execution: ExecutionContext
 }
 
-const registeredAuthorizations = new WeakMap<RuntimeAuthorization, RegisteredRuntimeAuthorization>()
+const registeredAuthorizations = new WeakMap<
+  RuntimeAuthorization,
+  RuntimeAuthorizationRegistration
+>()
+
+const MAX_DELEGATED_ACTION_APPLY_TARGETS = 4_096
+const MAX_DELEGATED_ACTION_IDENTIFIER_CHARACTERS = 1_000_000
 
 export function createPrincipalRuntimeAuthorization(input: {
-  readonly projectId: string
+  readonly execution: ExecutionContext
   readonly context: AuthorizationContext
   readonly credential?: Extract<AuthorizationRef, { readonly type: "principal" }>["credential"]
 }): RuntimeAuthorization {
+  if (input.execution.executor.type !== "request") {
+    throw new Error("[Sixb] Principal runtime authorization requires a request execution.")
+  }
   return createRegisteredPrincipalAuthorization(input)
 }
 
-/** Register service-account authority bound to one exact agent run. */
+/** Register restored authority bound to one exact agent run. */
 export function createAgentRuntimeAuthorization(input: {
-  readonly projectId: string
-  readonly context: AuthorizationContext
-  readonly executionId: string
-  readonly agentId: string
-  readonly runId: string
+  readonly execution: ExecutionContext
+  readonly authority:
+    | {
+        readonly type: "principal"
+        readonly context: AuthorizationContext
+        readonly credential?: Extract<
+          AuthorizationRef,
+          { readonly type: "principal" }
+        >["credential"]
+      }
+    | { readonly type: "disabled" }
 }): RuntimeAuthorization {
-  if (input.context.principal.type !== "serviceAccount") {
-    throw new Error("[Sixb] Agent execution authority must belong to a service account.")
-  }
-  assertNonEmpty(input.executionId, "Execution id")
-  assertNonEmpty(input.agentId, "Agent id")
-  assertNonEmpty(input.runId, "Agent run id")
-  return createRegisteredPrincipalAuthorization(input, {
-    type: "agent",
-    executionId: input.executionId,
-    agentId: input.agentId,
-    runId: input.runId,
+  if (input.execution.executor.type !== "agent") {
+    throw new Error("[Sixb] Agent runtime authorization requires an Agent execution.")
+  }
+
+  if (input.authority.type === "principal") {
+    return createRegisteredPrincipalAuthorization({
+      execution: input.execution,
+      context: input.authority.context,
+      ...(input.authority.credential === undefined
+        ? {}
+        : { credential: input.authority.credential }),
+    })
+  }
+
+  return register(input.execution, {
+    type: "unrestricted",
+    projectId: input.execution.projectId,
+    ref: Object.freeze({ type: "disabled" }),
   })
 }
 
-function createRegisteredPrincipalAuthorization(
-  input: {
-    readonly projectId: string
-    readonly context: AuthorizationContext
-    readonly credential?: Extract<AuthorizationRef, { readonly type: "principal" }>["credential"]
-  },
-  executionBinding?: AgentExecutionBinding
-): RuntimeAuthorization {
+function createRegisteredPrincipalAuthorization(input: {
+  readonly execution: ExecutionContext
+  readonly context: AuthorizationContext
+  readonly credential?: Extract<AuthorizationRef, { readonly type: "principal" }>["credential"]
+}): RuntimeAuthorization {
   const context = snapshotAuthorizationContext(input.context)
   const credential = input.credential ? snapshotCredential(input.credential) : undefined
   assertCredentialMatchesContext(context, credential)
@@ -94,41 +141,79 @@ function createRegisteredPrincipalAuthorization(
     principal: context.principal,
     ...(credential === undefined ? {} : { credential }),
   })
-  return register({
+  return register(input.execution, {
     type: "principal",
-    projectId: input.projectId,
+    projectId: input.execution.projectId,
     context,
     ref,
-    ...(executionBinding === undefined
-      ? {}
-      : { executionBinding: Object.freeze({ ...executionBinding }) }),
   })
 }
 
-export function createDisabledRuntimeAuthorization(projectId: string): RuntimeAuthorization {
-  return register({ type: "unrestricted", projectId, ref: Object.freeze({ type: "disabled" }) })
+export function createDisabledRuntimeAuthorization(
+  execution: ExecutionContext
+): RuntimeAuthorization {
+  return register(execution, {
+    type: "unrestricted",
+    projectId: execution.projectId,
+    ref: Object.freeze({ type: "disabled" }),
+  })
+}
+
+/** Register exact object-read authority without fabricating a principal identity. */
+export function createDelegatedRuntimeAuthorization(input: {
+  readonly execution: ExecutionContext
+  readonly objectRead: {
+    readonly selection: SelectedObjectReadScope
+    readonly limits: ObjectReadExecutionLimits
+  }
+  readonly actionApply?: readonly DelegatedActionApplyTarget[]
+  readonly delegation?: Extract<AuthorizationRef, { readonly type: "delegated" }>["delegation"]
+}): RuntimeAuthorization {
+  const execution = input.execution
+  const objectReadInput = input.objectRead
+  const actionApplyInput = input.actionApply
+  const delegationInput = input.delegation
+  const delegation =
+    delegationInput === undefined ? undefined : snapshotSharedDelegation(delegationInput)
+  if (execution.executor.type !== "request" || execution.requestedBy !== undefined) {
+    throw new Error(
+      "[Sixb] Delegated runtime authorization requires a request execution without a principal."
+    )
+  }
+
+  const objectRead = Object.freeze({
+    scope: compileSelectedObjectReadScope(objectReadInput.selection),
+    limits: snapshotObjectReadExecutionLimits(objectReadInput.limits),
+  })
+  return register(execution, {
+    type: "delegated",
+    projectId: execution.projectId,
+    objectRead,
+    actionApply: snapshotDelegatedActionApply(actionApplyInput ?? []),
+    ...(delegation === undefined ? {} : { delegation }),
+  })
 }
 
 export function createTrustedPrimitiveRuntimeAuthorization(input: {
-  readonly projectId: string
+  readonly execution: ExecutionContext
   readonly primitive: TrustedPrimitiveRef
 }): RuntimeAuthorization {
   const primitive = snapshotTrustedPrimitive(input.primitive)
-  return register({
+  return register(input.execution, {
     type: "unrestricted",
-    projectId: input.projectId,
+    projectId: input.execution.projectId,
     ref: Object.freeze({ type: "trustedPrimitive", primitive }),
   })
 }
 
 export function createKernelRuntimeAuthorization(input: {
-  readonly projectId: string
+  readonly execution: ExecutionContext
   readonly operation: KernelOperation
 }): RuntimeAuthorization {
   const operation = snapshotKernelOperation(input.operation)
-  return register({
+  return register(input.execution, {
     type: "unrestricted",
-    projectId: input.projectId,
+    projectId: input.execution.projectId,
     ref: Object.freeze({ type: "kernel", operation }),
   })
 }
@@ -137,7 +222,28 @@ export function resolveRuntimeAuthorization(authorization: unknown): ResolvedRun
   if (!isRuntimeAuthorizationCapability(authorization)) {
     return { type: "denied" }
   }
-  return registeredAuthorizations.get(authorization) ?? { type: "denied" }
+  return registeredAuthorizations.get(authorization)?.resolved ?? { type: "denied" }
+}
+
+/**
+ * Resolve authority from a runtime already admitted by `SixbHost.withScope`.
+ *
+ * Bound runtime facades carry no second execution value to recombine. Any lower-level boundary
+ * that receives an `ExecutionContext` separately must use `resolveExecutionScopeAuthorization`.
+ */
+export function resolveRuntimeAuthorizationForProject(input: {
+  readonly projectId: unknown
+  readonly runtimeAuthorization?: unknown
+}): ResolvedRuntimeAuthorization {
+  const resolved = resolveRuntimeAuthorization(input.runtimeAuthorization)
+  if (
+    resolved.type === "denied" ||
+    typeof input.projectId !== "string" ||
+    resolved.projectId !== input.projectId
+  ) {
+    return { type: "denied" }
+  }
+  return resolved
 }
 
 export function getAuthorizationRef(authorization: RuntimeAuthorization): AuthorizationRef {
@@ -145,9 +251,29 @@ export function getAuthorizationRef(authorization: RuntimeAuthorization): Author
   if (resolved.type === "denied") {
     throw new Error("[Sixb] Runtime authorization is not a registered Core capability.")
   }
+  if (resolved.type === "delegated") {
+    if (resolved.delegation) {
+      return { type: "delegated", delegation: { ...resolved.delegation } }
+    }
+    throw new Error(
+      "[Sixb] Delegated runtime authorization cannot cross a durable execution boundary."
+    )
+  }
   return cloneAuthorizationRef(resolved.ref)
 }
 
+function snapshotSharedDelegation(
+  input: Extract<AuthorizationRef, { readonly type: "delegated" }>["delegation"]
+): Extract<AuthorizationRef, { readonly type: "delegated" }>["delegation"] {
+  const kind = input.kind
+  const grantId = input.grantId
+  const sessionId = input.sessionId
+  if (kind !== "share") throw new Error("[Sixb] Unknown delegated authority provenance.")
+  assertNonEmpty(grantId, "Share grant id")
+  assertNonEmpty(sessionId, "Share session id")
+  return Object.freeze({ kind, grantId, sessionId })
+}
+
 export function assertExecutionScopeProject(projectId: string, scope: ExecutionScope): void {
   assertNonEmpty(projectId, "Project id")
   if (scope.execution.projectId !== projectId) {
@@ -187,22 +313,51 @@ export function assertExecutionScopeProject(projectId: string, scope: ExecutionS
   }
 }
 
+/**
+ * Capture the two opaque capabilities carried by a scope exactly once.
+ *
+ * Security-sensitive boundaries must not resolve a caller-owned wrapper and then read it again:
+ * accessor-backed inputs could otherwise substitute a different execution or authority between
+ * those operations.
+ */
+export function captureExecutionScope(scope: ExecutionScope): ExecutionScope {
+  const execution = scope.execution
+  const authorization = scope.authorization
+  return Object.freeze({ execution, authorization })
+}
+
 /** Validate that one registered authority belongs to the exact execution it accompanies. */
 export function resolveExecutionScopeAuthorization(
   projectId: string,
   scope: ExecutionScope
 ): RegisteredRuntimeAuthorization {
-  assertExecutionScopeProject(projectId, scope)
-  const resolved = resolveRuntimeAuthorization(scope.authorization)
+  const capturedScope = captureExecutionScope(scope)
+  assertExecutionScopeProject(projectId, capturedScope)
+  const resolved = resolveRuntimeAuthorization(capturedScope.authorization)
   if (resolved.type === "denied") {
     throw createSixbError(
       "internal.unexpected",
       "[Sixb] Execution scope carries unregistered runtime authorization.",
-      { details: { executionId: scope.execution.id, projectId } }
+      { details: { executionId: capturedScope.execution.id, projectId } }
     )
   }
 
-  const { execution } = scope
+  const registration = registeredAuthorizations.get(capturedScope.authorization)
+  if (!registration || !executionMatchesBinding(registration.execution, capturedScope.execution)) {
+    throw invalidExecutionAuthority(
+      capturedScope.execution.id,
+      "authority is bound to different execution provenance"
+    )
+  }
+
+  assertResolvedAuthorizationMatchesExecution(resolved, capturedScope.execution)
+  return resolved
+}
+
+function assertResolvedAuthorizationMatchesExecution(
+  resolved: RegisteredRuntimeAuthorization,
+  execution: ExecutionContext
+): void {
   switch (execution.executor.type) {
     case "request":
       if (
@@ -211,27 +366,31 @@ export function resolveExecutionScopeAuthorization(
       ) {
         throw invalidExecutionAuthority(execution.id, "request source does not match its executor")
       }
-      if (resolved.ref.type === "principal") {
-        if (
-          resolved.type !== "principal" ||
-          resolved.executionBinding !== undefined ||
-          !principalsEqual(execution.requestedBy, resolved.ref.principal)
-        ) {
+      if (resolved.type === "principal") {
+        if (!principalsEqual(execution.requestedBy, resolved.ref.principal)) {
           throw invalidExecutionAuthority(
             execution.id,
             "request authority does not match its requested-by principal"
           )
         }
-        return resolved
+        return
+      }
+      if (
+        resolved.type === "unrestricted" &&
+        resolved.ref.type === "disabled" &&
+        execution.requestedBy === undefined
+      ) {
+        return
       }
-      if (resolved.ref.type === "disabled" && execution.requestedBy === undefined) return resolved
+      if (resolved.type === "delegated" && execution.requestedBy === undefined) return
       throw invalidExecutionAuthority(
         execution.id,
-        "request execution requires principal or explicitly disabled authority"
+        "request execution requires principal, delegated, or explicitly disabled authority"
       )
 
     case "primitive":
       if (
+        resolved.type !== "unrestricted" ||
         resolved.ref.type !== "trustedPrimitive" ||
         resolved.ref.primitive.kind !== execution.executor.kind ||
         resolved.ref.primitive.id !== execution.executor.id ||
@@ -242,28 +401,45 @@ export function resolveExecutionScopeAuthorization(
           "trusted primitive authority does not match its executor"
         )
       }
-      return resolved
+      return
 
     case "agent":
-      if (
-        resolved.type !== "principal" ||
-        resolved.ref.type !== "principal" ||
-        resolved.ref.principal.type !== "serviceAccount" ||
-        resolved.ref.credential !== undefined ||
-        resolved.executionBinding?.type !== "agent" ||
-        resolved.executionBinding.executionId !== execution.id ||
-        resolved.executionBinding.agentId !== execution.executor.agentId ||
-        resolved.executionBinding.runId !== execution.executor.runId
-      ) {
+      if (execution.source.type !== "execution") {
         throw invalidExecutionAuthority(
           execution.id,
-          "agent authority does not match its execution binding"
+          "agent execution requires an execution source"
         )
       }
-      return resolved
+      if (resolved.type === "principal" && resolved.ref.type === "principal") {
+        if (resolved.ref.principal.type === "serviceAccount") {
+          const actorId = execution.executor.actorId
+          if (
+            actorId === undefined ||
+            resolved.ref.principal.id !== agentServiceAccountId(actorId) ||
+            resolved.ref.credential !== undefined
+          ) {
+            throw invalidExecutionAuthority(
+              execution.id,
+              "agent authority must reference its managed service account"
+            )
+          }
+        } else if (resolved.ref.credential === undefined) {
+          throw invalidExecutionAuthority(
+            execution.id,
+            "inherited user agent authority requires a credential"
+          )
+        }
+        return
+      }
+      if (resolved.type === "unrestricted" && resolved.ref.type === "disabled") return
+      throw invalidExecutionAuthority(
+        execution.id,
+        "agent authority must be principal or explicitly disabled"
+      )
 
     case "kernel":
       if (
+        resolved.type !== "unrestricted" ||
         resolved.ref.type !== "kernel" ||
         execution.requestedBy !== undefined ||
         resolved.ref.operation.type !== execution.executor.operation.type ||
@@ -274,7 +450,7 @@ export function resolveExecutionScopeAuthorization(
           "kernel authority does not match its executor"
         )
       }
-      return resolved
+      return
   }
 }
 
@@ -293,22 +469,122 @@ function invalidExecutionAuthority(executionId: string, reason: string): Error {
   )
 }
 
-function register(input: RegisteredRuntimeAuthorization): RuntimeAuthorization {
+function register(
+  execution: ExecutionContext,
+  input: RegisteredRuntimeAuthorization
+): RuntimeAuthorization {
   assertNonEmpty(input.projectId, "Authorization project id")
+  const executionBinding = snapshotExecutionContext(execution)
+  if (input.projectId !== executionBinding.projectId) {
+    throw new Error(
+      `[Sixb] Runtime authorization belongs to project '${input.projectId}', not execution project '${executionBinding.projectId}'.`
+    )
+  }
+  assertResolvedAuthorizationMatchesExecution(input, executionBinding)
   const authorization = createRuntimeAuthorizationCapability()
-  registeredAuthorizations.set(authorization, Object.freeze(input))
+  registeredAuthorizations.set(
+    authorization,
+    Object.freeze({ resolved: Object.freeze(input), execution: executionBinding })
+  )
   return authorization
 }
 
+function executionMatchesBinding(binding: ExecutionContext, execution: ExecutionContext): boolean {
+  try {
+    return isDeepStrictEqual(binding, snapshotExecutionContext(execution))
+  } catch {
+    return false
+  }
+}
+
+function snapshotExecutionContext(execution: ExecutionContext): ExecutionContext {
+  assertNonEmpty(execution.id, "Execution id")
+  assertNonEmpty(execution.projectId, "Execution project id")
+  assertNonEmpty(execution.correlationId, "Execution correlation id")
+  return Object.freeze({
+    id: execution.id,
+    projectId: execution.projectId,
+    ...(execution.requestedBy === undefined
+      ? {}
+      : { requestedBy: snapshotAuthorizablePrincipal(execution.requestedBy) }),
+    executor: snapshotExecutionExecutor(execution.executor),
+    source: snapshotExecutionSource(execution.source),
+    correlationId: execution.correlationId,
+  })
+}
+
+function snapshotExecutionExecutor(
+  executor: ExecutionContext["executor"]
+): ExecutionContext["executor"] {
+  switch (executor.type) {
+    case "request":
+      assertNonEmpty(executor.requestId, "Execution request id")
+      return Object.freeze({ type: "request", requestId: executor.requestId })
+    case "primitive": {
+      const primitive = snapshotTrustedPrimitive(executor)
+      return Object.freeze({ type: "primitive", ...primitive })
+    }
+    case "agent":
+      if (executor.actorId !== undefined)
+        assertNonEmpty(executor.actorId, "Execution Agent actor id")
+      assertNonEmpty(executor.runId, "Execution Agent run id")
+      return Object.freeze({
+        type: "agent",
+        ...(executor.actorId === undefined ? {} : { actorId: executor.actorId }),
+        runId: executor.runId,
+      })
+    case "kernel":
+      return Object.freeze({
+        type: "kernel",
+        operation: snapshotKernelOperation(executor.operation),
+      })
+  }
+  throw new Error(
+    `[Sixb] Unknown execution executor type '${String((executor as { type?: unknown }).type)}'.`
+  )
+}
+
+function snapshotExecutionSource(source: ExecutionContext["source"]): ExecutionContext["source"] {
+  switch (source.type) {
+    case "http":
+      assertNonEmpty(source.requestId, "Execution source request id")
+      return Object.freeze({ type: "http", requestId: source.requestId })
+    case "webhook":
+      assertNonEmpty(source.deliveryId, "Execution source delivery id")
+      return Object.freeze({ type: "webhook", deliveryId: source.deliveryId })
+    case "schedule":
+    case "event":
+      assertNonEmpty(source.eventId, "Execution source event id")
+      return Object.freeze({ type: source.type, eventId: source.eventId })
+    case "datasetVersion":
+      assertNonEmpty(source.datasetId, "Execution source dataset id")
+      assertNonEmpty(source.versionId, "Execution source dataset version id")
+      return Object.freeze({
+        type: "datasetVersion",
+        datasetId: source.datasetId,
+        versionId: source.versionId,
+      })
+    case "execution":
+      assertNonEmpty(source.executionId, "Execution source execution id")
+      return Object.freeze({ type: "execution", executionId: source.executionId })
+  }
+  throw new Error(
+    `[Sixb] Unknown execution source type '${String((source as { type?: unknown }).type)}'.`
+  )
+}
+
 function snapshotAuthorizationContext(
   context: AuthorizationContext
 ): PrincipalAuthorizationContext {
   const principal = snapshotAuthorizablePrincipal(context.principal)
-  const grants = emptyGrantSets()
-  for (const kind of GRANT_KIND_KEYS) {
-    grants[kind] = new Set(context.grants[kind])
+  const grants = {} as Record<TargetedGrantKind, ReadonlySet<string>>
+  for (const kind of TARGETED_GRANT_KIND_KEYS) {
+    grants[kind] = new ImmutableGrantSet(context.grants[kind])
   }
-  const frozenGrants: GrantIndex = Object.freeze(grants)
+  const frozenGrants: GrantIndex = Object.freeze({
+    ...grants,
+    "run:agent": context.grants["run:agent"],
+  })
   return Object.freeze({
     principal,
     ...(context.sessionId === undefined ? {} : { sessionId: context.sessionId }),
@@ -318,6 +594,68 @@ function snapshotAuthorizationContext(
   })
 }
 
+/** Read-only Set semantics with no mutable handle hidden behind the TypeScript interface. */
+class ImmutableGrantSet implements ReadonlySet<string> {
+  readonly #values: Set<string>
+  readonly [Symbol.toStringTag] = "Set"
+
+  constructor(values: Iterable<string>) {
+    this.#values = new Set(values)
+    Object.freeze(this)
+  }
+
+  get size(): number {
+    return this.#values.size
+  }
+
+  has(value: string): boolean {
+    return this.#values.has(value)
+  }
+
+  entries(): ReturnType<Set<string>["entries"]> {
+    return this.#values.entries()
+  }
+
+  keys(): ReturnType<Set<string>["keys"]> {
+    return this.#values.keys()
+  }
+
+  values(): ReturnType<Set<string>["values"]> {
+    return this.#values.values()
+  }
+
+  [Symbol.iterator](): ReturnType<Set<string>[typeof Symbol.iterator]> {
+    return this.#values[Symbol.iterator]()
+  }
+
+  forEach(
+    callback: (value: string, valueAgain: string, set: ReadonlySet<string>) => void,
+    thisArg?: unknown
+  ): void {
+    for (const value of this.#values) {
+      callback.call(thisArg, value, value, this)
+    }
+  }
+
+  add(_value: string): never {
+    throw immutableGrantSetMutation()
+  }
+
+  delete(_value: string): never {
+    throw immutableGrantSetMutation()
+  }
+
+  clear(): never {
+    throw immutableGrantSetMutation()
+  }
+}
+
+Object.freeze(ImmutableGrantSet.prototype)
+
+function immutableGrantSetMutation(): Error {
+  return new Error("[Sixb] Runtime authorization grants are immutable.")
+}
+
 function snapshotAuthorizablePrincipal(principal: Principal): AuthorizablePrincipal {
   if (principal.type !== "user" && principal.type !== "serviceAccount") {
     throw new Error(`[Sixb] Principal type '${principal.type}' cannot hold runtime authorization.`)
@@ -373,6 +711,76 @@ function snapshotKernelOperation(operation: KernelOperation): KernelOperation {
   return Object.freeze({ type: operation.type, recoveryId: operation.recoveryId })
 }
 
+/** Validate, bound, and detach exact delegated Action targets before registering authority. */
+function snapshotDelegatedActionApply(
+  input: readonly DelegatedActionApplyTarget[]
+): readonly DelegatedActionApplyTarget[] {
+  if (!Array.isArray(input)) {
+    throw new Error("[Sixb] Delegated Action targets must be an array.")
+  }
+
+  const targetCount = input.length
+  if (targetCount > MAX_DELEGATED_ACTION_APPLY_TARGETS) {
+    throw new Error(
+      `[Sixb] Delegated authority exceeds the maximum of ${MAX_DELEGATED_ACTION_APPLY_TARGETS} Action targets.`
+    )
+  }
+
+  let identifierCharacters = 0
+  const targets: DelegatedActionApplyTarget[] = []
+  for (let index = 0; index < targetCount; index += 1) {
+    const authoredTarget = input[index]
+    if (!isRecord(authoredTarget)) {
+      throw new Error(`[Sixb] Delegated Action target ${index} must be an object.`)
+    }
+
+    const authoredActionId = authoredTarget.actionId
+    const authoredSubject = authoredTarget.subject
+    if (!isRecord(authoredSubject)) {
+      throw new Error(`[Sixb] Delegated Action target ${index} subject must be an ObjectRef.`)
+    }
+
+    const actionId = delegatedActionIdentifier(
+      authoredActionId,
+      `Delegated Action target ${index} action id`
+    )
+    const objectTypeId = delegatedActionIdentifier(
+      authoredSubject.objectTypeId,
+      `Delegated Action target ${index} subject object type id`
+    )
+    const primaryId = delegatedActionIdentifier(
+      authoredSubject.primaryId,
+      `Delegated Action target ${index} subject primary id`
+    )
+    identifierCharacters += actionId.length + objectTypeId.length + primaryId.length
+    if (identifierCharacters > MAX_DELEGATED_ACTION_IDENTIFIER_CHARACTERS) {
+      throw new Error(
+        `[Sixb] Delegated authority exceeds the maximum of ${MAX_DELEGATED_ACTION_IDENTIFIER_CHARACTERS} Action identifier characters.`
+      )
+    }
+
+    targets.push(
+      Object.freeze({
+        actionId,
+        subject: Object.freeze({ objectTypeId, primaryId }),
+      })
+    )
+  }
+
+  return Object.freeze(targets)
+}
+
+function delegatedActionIdentifier(value: unknown, label: string): string {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`[Sixb] ${label} must not be empty.`)
+  }
+  return value
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
 function cloneAuthorizationRef(ref: AuthorizationRef): AuthorizationRef {
   switch (ref.type) {
     case "principal":
@@ -383,6 +791,8 @@ function cloneAuthorizationRef(ref: AuthorizationRef): AuthorizationRef {
       }
     case "trustedPrimitive":
       return { type: "trustedPrimitive", primitive: { ...ref.primitive } }
+    case "delegated":
+      return { type: "delegated", delegation: { ...ref.delegation } }
     case "kernel":
       return { type: "kernel", operation: { ...ref.operation } }
     case "disabled":