@sixb/core 0.1.7 → 0.1.8

package/src/agents/execution.ts

@@ -1,6 +1,7 @@
 import { principalsEqual, SYSTEM_PRINCIPAL } from "../auth"
-import { assertAuthorized, isAllowed } from "../authorization"
+import { assertAuthorized, isRuntimeAllowed } from "../authorization"
 import type { AuthorizablePrincipal, ExecutionContext } from "../execution"
+import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
 import type { ModelCatalog } from "../models"
 import { resolveExecutionCosts } from "../runtime/ai-cost"
 import { resolveExecutionUsage } from "../runtime/ai-usage"
@@ -82,22 +83,25 @@ export function createAgentRuntime(
   execution: ExecutionContext,
   models?: ModelCatalog
 ): AgentRuntime {
-  const principal = runtime.authorization?.principal ?? SYSTEM_PRINCIPAL
-  const allowed = () => isAllowed(runtime.authorization, { kind: "agent.run" })
+  const authority = resolveRuntimeAuthorizationForProject(runtime)
+  const principal = authority.type === "principal" ? authority.context.principal : SYSTEM_PRINCIPAL
+  const allowed = () => isRuntimeAllowed(runtime, { kind: "agent.run" })
 
   const getVisibleThreadRecord = async (threadId: string): Promise<AgentThreadRecord | null> => {
+    if (authority.type === "denied" || authority.type === "delegated") return null
     const thread =
       (await runtime.storage.agents?.threads.getById({
         projectId: runtime.projectId,
         id: threadId,
       })) ?? null
     if (!thread || !allowed()) return null
-    return runtime.authorization && !principalsEqual(principal, thread.ownerPrincipal)
+    return authority.type === "principal" && !principalsEqual(principal, thread.ownerPrincipal)
       ? null
       : thread
   }
 
   const getAgent = (): AgentDescriptor | null => {
+    if (authority.type === "denied" || authority.type === "delegated") return null
     const model = models?.language.default
     if (!model || !allowed()) return null
     return {
@@ -107,6 +111,7 @@ export function createAgentRuntime(
   }
 
   const getVisibleRunRecord = async (runId: string): Promise<ConversationAgentRunRecord | null> => {
+    if (authority.type === "denied" || authority.type === "delegated") return null
     const run =
       (await runtime.storage.agents?.runs.getById({
         projectId: runtime.projectId,
@@ -148,12 +153,15 @@ export function createAgentRuntime(
       getById: getVisibleThreadRecord,
       list: async (input = {}) => {
         assertNoAgentSelector(input)
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return { threads: [], hasMore: false, total: 0 }
+        }
         const storage = runtime.storage.agents
         if (!storage || !allowed()) return { threads: [], hasMore: false, total: 0 }
         return storage.threads.list({
           ...input,
           projectId: runtime.projectId,
-          ownerPrincipal: runtime.authorization ? principal : undefined,
+          ownerPrincipal: authority.type === "principal" ? principal : undefined,
         })
       },
     },

package/src/agents/identity.ts

@@ -0,0 +1,4 @@
+/** Deterministic managed service-account id owned by one framework Agent actor. */
+export function agentServiceAccountId(actorId: string): string {
+  return `svc_agent_${actorId}`
+}

package/src/agents/index.ts

@@ -1,28 +1,10 @@
 export type {
   AgentFileDataProjection,
   AgentFileDataResolverInput,
-  AgentInboundUiMessage,
-  AgentInboundUiMessagePart,
-  AgentModelAssistantPart,
-  AgentModelFilePart,
-  AgentModelMessage,
-  AgentModelReasoningPart,
-  AgentModelTextPart,
-  AgentModelToolCallPart,
-  AgentModelToolOutput,
-  AgentModelToolResultPart,
   AgentToolResultFileResolverInput,
-  AgentUiMessage,
-  AgentUiMessagePart,
-  AgentUiToolPart,
   ToModelMessagesOptions,
 } from "./adapters"
-export {
-  fromUiMessage,
-  omitUndefinedObjectProperties,
-  toModelMessages,
-  toUiMessage,
-} from "./adapters"
+export { toModelMessages } from "./adapters"
 export type { AgentApiGatewayCapabilityInput, AgentApiRoute } from "./api-gateway"
 export {
   AGENT_API_GATEWAY_PREFIX,
@@ -85,7 +67,6 @@ export {
 } from "./dispatch"
 export {
   AgentDefinitionError,
-  AgentMessageAdapterError,
   AgentRequestError,
   type AgentRequestErrorCode,
   AgentToolPublicError,

package/src/agents/message.ts

@@ -10,9 +10,8 @@ import type { AgentContextPart } from "./context"
  * column) versions the parts shape so it can be migrated.
  *
  * The part union is intentionally focused on what agent runs actually produce (text, reasoning, step
- * boundaries, tool calls). It is extensible: adding a part kind later is non-breaking. The adapter
- * `fromUiMessage` is total — it throws on any part it cannot model rather than dropping it silently,
- * which both prevents data loss and signals exactly when the union must grow.
+ * boundaries, tool calls). The model loop validates and normalizes output before its steps are
+ * projected into this union; storage validates the durable write contract independently.
  */
 export const AGENT_MESSAGE_CONTENT_VERSION = 2 as const
 
@@ -53,7 +52,7 @@ interface AgentToolCallBase {
   readonly type: "tool-call"
   readonly toolCallId: string
   readonly toolName: string
-  /** `true` when reconstructed from a dynamic tool part (vs a static `tool-${name}` part). */
+  /** `true` when the model identifies the call as a dynamic tool. */
   readonly dynamic?: boolean
   /** `true` when the provider executed the tool inline (steers model projection). */
   readonly providerExecuted?: boolean
@@ -95,6 +94,6 @@ export type AgentToolCallState = AgentToolCallPart["state"]
 export interface AgentMessage {
   readonly role: AgentMessageRole
   readonly parts: readonly AgentMessagePart[]
-  /** Message-level metadata (mirrors `UIMessage.metadata`). */
+  /** Optional JSON metadata associated with the message. */
   readonly metadata?: JsonValue
 }

package/src/agents/model-loop.ts

@@ -1,5 +1,11 @@
 import { randomUUID } from "node:crypto"
-import { assertJsonObject, assertJsonValue, isJsonValue, type JsonValue } from "../json"
+import {
+  assertJsonObject,
+  assertJsonValue,
+  isJsonValue,
+  isPlainRecord,
+  type JsonValue,
+} from "../json"
 import { ModelProviderError, ModelStreamError, StructuredOutputError } from "../models/errors"
 import type {
   LanguageModelStreamEvent,
@@ -110,6 +116,8 @@ interface ParsedToolCall {
  *
  * One step is exactly one provider call. Lifecycle and stream callbacks are awaited so the caller
  * controls backpressure and can fail closed before another billable call starts.
+ * Completed steps and partial content contain validated JSON payloads and normalized provider
+ * metadata. Trace adapters may project these results directly; storage owns write validation.
  */
 export function runModelLoop<TOutput = string>(
   input: RunModelLoopInput<TOutput>
@@ -523,6 +531,11 @@ function validateModelToolOutput(output: ModelToolOutput, toolName: string): voi
     }
     return
   }
+  if (output.type !== "json" && output.type !== "error-json") {
+    throw new TypeError(
+      `[SixbModels] Tool '${toolName}' returned an unsupported model output type.`
+    )
+  }
   assertJsonValue(output.value, `tool '${toolName}' model output`)
 }
 
@@ -537,6 +550,9 @@ function modelToolOutput(value: JsonValue): ModelToolOutput {
 }
 
 function toolErrorResult(part: ModelToolCallPart, errorText: string): ModelToolResultPart {
+  if (typeof errorText !== "string") {
+    throw new TypeError(`[SixbModels] Tool '${part.toolName}' error text must be a string.`)
+  }
   return {
     type: "tool-result",
     toolCallId: part.toolCallId,
@@ -645,6 +661,12 @@ class StreamAccumulator {
         this.addProviderToolResult(event)
         return
       case "provider-state":
+        if (typeof event.providerId !== "string" || event.providerId.length === 0) {
+          this.captureProjectionError(
+            new ModelStreamError("[SixbModels] Provider state requires a nonempty provider ID.")
+          )
+          return
+        }
         if (this.captureProviderState(event.data)) {
           this.parts.push({
             type: "provider-state",
@@ -836,7 +858,12 @@ class StreamAccumulator {
     event: Extract<LanguageModelStreamEvent, { type: "tool-input-start" }>
   ): Promise<void> {
     this.requireStarted(event.type)
-    if (!event.id || !event.toolName) {
+    if (
+      typeof event.id !== "string" ||
+      !event.id ||
+      typeof event.toolName !== "string" ||
+      !event.toolName
+    ) {
       throw new ModelStreamError("[SixbModels] Tool calls require nonempty IDs and names.")
     }
     if (this.toolCalls.has(event.id)) {
@@ -932,8 +959,7 @@ class StreamAccumulator {
   private captureProviderData(data: ProviderData | undefined): ProviderData | undefined {
     if (data === undefined) return undefined
     try {
-      validateProviderData(data)
-      return data
+      return normalizeProviderData(data)
     } catch (error) {
       this.captureProjectionError(error)
       return undefined
@@ -993,8 +1019,8 @@ function validateUsage(usage: ModelUsage): void {
   }
 }
 
-function validateProviderData(data: ProviderData | undefined): void {
-  if (data === undefined) return
+function normalizeProviderData(value: ProviderData): ProviderData {
+  const data = omitUndefinedObjectProperties(value)
   assertJsonValue(data, "provider data")
   if (typeof data !== "object" || data === null || Array.isArray(data)) {
     throw new TypeError("[SixbModels] provider data must be a JSON object.")
@@ -1004,6 +1030,28 @@ function validateProviderData(data: ProviderData | undefined): void {
       `[SixbModels] Provider data exceeds the ${MAX_PROVIDER_DATA_BYTES}-byte response limit.`
     )
   }
+  return data
+}
+
+/** Normalize absent metadata fields at ingestion, leaving non-JSON values for validation. */
+function omitUndefinedObjectProperties(value: unknown, seen = new Set<object>()): unknown {
+  if (typeof value !== "object" || value === null || seen.has(value)) return value
+  seen.add(value)
+  try {
+    if (Array.isArray(value)) {
+      return value.map((entry) => omitUndefinedObjectProperties(entry, seen))
+    }
+    if (!isPlainRecord(value)) return value
+    return Object.fromEntries(
+      Reflect.ownKeys(value)
+        .filter((key) => Object.prototype.propertyIsEnumerable.call(value, key))
+        .map((key) => [key, Reflect.get(value, key)] as const)
+        .filter(([, entry]) => entry !== undefined)
+        .map(([key, entry]) => [key, omitUndefinedObjectProperties(entry, seen)])
+    )
+  } finally {
+    seen.delete(value)
+  }
 }
 
 function mergeProviderData(

package/src/agents/request.ts

@@ -8,6 +8,7 @@ import {
   canInheritAgentRequestAuthorization,
   createInheritedAgentExecutionRecord,
 } from "../execution/agent"
+import { resolveExecutionScopeAuthorization } from "../execution/authorization"
 import { ensureExecutionRecord, executionRecordInputFromRuntime } from "../execution/durable"
 import type { ExecutionContext } from "../execution/types"
 import type { LanguageModelCatalog, LanguageModelRef } from "../models"
@@ -81,6 +82,10 @@ export async function requestAgentRun(
   models: LanguageModelCatalog | undefined,
   input: RequestAgentRunInput
 ): Promise<RequestAgentRunResult> {
+  const authority = resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization,
+  })
   assertNoAgentSelector(input)
   assertAuthorized(runtime, { kind: "agent.run" })
   assertRequestAuthorityCanRunAgent(runtime)
@@ -92,9 +97,13 @@ export async function requestAgentRun(
 
   const agents = requireAgentStorage(runtime)
   const projectId = runtime.projectId
-  // A scoped runtime is authoritative for caller identity. `input.principal` remains available to
-  // privileged server integrations that have already authenticated their request.
-  const principal = runtime.authorization?.principal ?? input.principal ?? SYSTEM_PRINCIPAL
+  // Attribution comes from the exact capability/execution pair, never the optional context cache
+  // on the runtime. `input.principal` remains available to unrestricted server integrations that
+  // have already authenticated their request.
+  const principal =
+    authority.type === "principal"
+      ? authority.context.principal
+      : (input.principal ?? SYSTEM_PRINCIPAL)
   const runId = createAgentRunId()
   const durableExecution = await prepareDurableAgentExecution(runtime, execution, runId)
   const requesterGroupIds = durableExecution.requestedBy
@@ -179,6 +188,10 @@ export async function retryAgentRun(
   models: LanguageModelCatalog | undefined,
   failedRun: ConversationAgentRunRecord
 ): Promise<RequestAgentRunResult> {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization,
+  })
   assertAuthorized(runtime, { kind: "agent.run" })
   assertRequestAuthorityCanRunAgent(runtime)
   if (failedRun.status !== "failed") {

package/src/agents/tool-definition.ts

@@ -13,7 +13,6 @@ import type {
   InferAgentToolInputSchema,
 } from "./types"
 import {
-  assertValidAgentToolDefinitions,
   assertValidAgentToolDescription,
   assertValidAgentToolName,
   assertValidProjectAgentToolDefinitions,
@@ -73,24 +72,6 @@ export function createAgentToolDefinition<
   return Object.freeze(tool)
 }
 
-export function toolsFromDefinitions(
-  agentId: string,
-  tools: readonly AgentToolDefinition[] | undefined
-): readonly AgentToolDefinition[] {
-  if (tools === undefined) {
-    return EMPTY_AGENT_TOOLS
-  }
-  if (!Array.isArray(tools)) {
-    throw new AgentDefinitionError(
-      `[Sixb] Agent '${agentId}' tools must be an array of agent tool definitions.`
-    )
-  }
-
-  assertValidAgentToolDefinitions(agentId, tools)
-
-  return normalizeAgentToolDefinitions(tools)
-}
-
 export function toolsFromProjectConfig(
   tools: readonly AgentToolDefinition[] | undefined
 ): readonly AgentToolDefinition[] {

package/src/agents/validation.ts

@@ -6,7 +6,6 @@ import {
   type ValueType,
   validateSchemaValue,
 } from "../ontology"
-import type { GroupDefinition } from "../security"
 import { AgentDefinitionError } from "./errors"
 import type { AgentToolDefinition, AgentToolInputSchema } from "./types"
 
@@ -31,12 +30,6 @@ export const AGENT_RESERVED_TOOL_NAMES = [
   "wait_agent",
 ] as const
 
-export function assertNonEmpty(value: string, field: string): void {
-  if (!value.trim()) {
-    throw new AgentDefinitionError(`[Sixb] Agent ${field} must not be empty.`)
-  }
-}
-
 export function isAgentToolDefinition(value: unknown): value is AgentToolDefinition {
   return (
     isRecord(value) &&
@@ -126,38 +119,6 @@ export function validateAndNormalizeAgentToolInput(
   )
 }
 
-export function groupIdsFromDefinitions(
-  agentId: string,
-  groups: readonly GroupDefinition[] | undefined
-): readonly string[] {
-  const groupIds = (groups ?? []).map((group) => {
-    if (!isRecord(group) || group.kind !== "group") {
-      throw new AgentDefinitionError(
-        `[Sixb] Agent '${agentId}' groups must contain only group definitions.`
-      )
-    }
-
-    assertNonEmpty(group.id, `Agent '${agentId}' group id`)
-    return group.id
-  })
-
-  assertNoDuplicateGroupIds(agentId, groupIds)
-  return Object.freeze(groupIds)
-}
-
-function assertNoDuplicateGroupIds(agentId: string, groupIds: readonly string[]): void {
-  const seen = new Set<string>()
-  for (const groupId of groupIds) {
-    assertNonEmpty(groupId, `Agent '${agentId}' group id`)
-    if (seen.has(groupId)) {
-      throw new AgentDefinitionError(
-        `[Sixb] Agent '${agentId}' groups contains duplicate group id '${groupId}'.`
-      )
-    }
-    seen.add(groupId)
-  }
-}
-
 function assertValidAgentToolSchema(
   toolName: string,
   schema: unknown,
@@ -238,45 +199,25 @@ function invalidAgentToolSchema(toolName: string, path: string): AgentDefinition
   )
 }
 
-export function assertValidAgentToolDefinitions(
-  agentId: string,
-  tools: readonly AgentToolDefinition[]
-): void {
-  assertValidAgentToolDefinitionList(tools, {
-    invalidDefinitions: `[Sixb] Agent '${agentId}' tools must contain only agent tool definitions.`,
-    duplicateName: (name) =>
-      `[Sixb] Agent '${agentId}' tools contains duplicate tool name '${name}'.`,
-  })
-}
-
 export function assertValidProjectAgentToolDefinitions(
   tools: readonly AgentToolDefinition[]
-): void {
-  assertValidAgentToolDefinitionList(tools, {
-    invalidDefinitions: "[Sixb] Project tools must contain only agent tool definitions.",
-    duplicateName: (name) => `[Sixb] Project tools contain duplicate tool name '${name}'.`,
-  })
-}
-
-function assertValidAgentToolDefinitionList(
-  tools: readonly AgentToolDefinition[],
-  messages: {
-    readonly invalidDefinitions: string
-    readonly duplicateName: (name: string) => string
-  }
 ): void {
   const seen = new Set<string>()
   for (let index = 0; index < tools.length; index += 1) {
     const tool = tools[index]
     if (!Object.hasOwn(tools, index) || !isAgentToolDefinition(tool)) {
-      throw new AgentDefinitionError(messages.invalidDefinitions)
+      throw new AgentDefinitionError(
+        "[Sixb] Project tools must contain only agent tool definitions."
+      )
     }
 
     assertValidAgentToolName(tool.name)
     assertValidAgentToolDescription(tool.name, tool.description)
     assertValidAgentToolInput(tool.name, tool.input)
     if (seen.has(tool.name)) {
-      throw new AgentDefinitionError(messages.duplicateName(tool.name))
+      throw new AgentDefinitionError(
+        `[Sixb] Project tools contain duplicate tool name '${tool.name}'.`
+      )
     }
     seen.add(tool.name)
   }

package/src/ai-usage/execution.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto"
-import { assertAuthorized, assertRuntimeAuthorizationBound, isAllowed } from "../authorization"
+import { assertAuthorized, isRuntimeAllowed } from "../authorization"
 import type { SixbRuntimeContext } from "../runtime/types"
 import type { SecurityDefinitionCatalog } from "../security"
 import type {
@@ -87,11 +87,9 @@ export function createAiUsageRuntime(
   const assertObservable = () => assertAuthorized(runtime, { kind: "aiUsage.observe" })
   const assertManageable = () => assertAuthorized(runtime, { kind: "aiUsage.manage" })
   const assertPolicyReadable = () => {
-    const resolved = assertRuntimeAuthorizationBound(runtime)
     if (
-      resolved.type === "principal" &&
-      !isAllowed(resolved.context, { kind: "aiUsage.observe" }) &&
-      !isAllowed(resolved.context, { kind: "aiUsage.manage" })
+      !isRuntimeAllowed(runtime, { kind: "aiUsage.observe" }) &&
+      !isRuntimeAllowed(runtime, { kind: "aiUsage.manage" })
     ) {
       assertObservable()
     }
@@ -114,12 +112,7 @@ export function createAiUsageRuntime(
     limitsConfigured: runtime.storage.aiLimits !== undefined,
     assertObservable,
     assertManageable,
-    canManageLimits: () => {
-      const resolved = assertRuntimeAuthorizationBound(runtime)
-      return (
-        resolved.type !== "principal" || isAllowed(resolved.context, { kind: "aiUsage.manage" })
-      )
-    },
+    canManageLimits: () => isRuntimeAllowed(runtime, { kind: "aiUsage.manage" }),
     queryOverview: (input) => {
       assertObservable()
       return requireCosts().queryProjectOverview({ ...input, projectId: runtime.projectId })

package/src/authorization/decision.ts

@@ -13,7 +13,8 @@
 import type { AuthSessionAudience } from "../auth/audience"
 import {
   type ResolvedRuntimeAuthorization,
-  resolveRuntimeAuthorization,
+  resolveExecutionScopeAuthorization,
+  resolveRuntimeAuthorizationForProject,
 } from "../execution/authorization"
 import type { ExecutionContext, RuntimeAuthorization } from "../execution/types"
 import { AuthorizationError } from "./errors"
@@ -28,6 +29,7 @@ export type AuthzRequest =
   | { readonly kind: "object.edit"; readonly objectTypeId: string }
   | { readonly kind: "telemetry.append"; readonly objectTypeId: string }
   | { readonly kind: "action.apply"; readonly actionId: string }
+  | { readonly kind: "share.manage"; readonly shareId: string }
   | { readonly kind: "workflow.run"; readonly workflowId: string }
   | { readonly kind: "sync.run"; readonly syncId: string }
   | { readonly kind: "pipeline.run"; readonly pipelineId: string }
@@ -47,6 +49,7 @@ export interface AuthzDecision {
 }
 
 interface AuthorizedRuntime {
+  readonly projectId: string
   readonly runtimeAuthorization?: RuntimeAuthorization
   readonly authorization?: AuthorizationContext
 }
@@ -73,6 +76,8 @@ function atomsFor(request: AuthzRequest): readonly Atom[] {
       return [{ kind: "append:telemetry", id: request.objectTypeId }]
     case "action.apply":
       return [{ kind: "apply:action", id: request.actionId }]
+    case "share.manage":
+      return [{ kind: "share:share", id: request.shareId }]
     case "workflow.run":
       return [{ kind: "run:workflow", id: request.workflowId }]
     case "sync.run":
@@ -133,6 +138,12 @@ export function isAllowed(
 
 export function assertAuthorized(runtime: AuthorizedRuntime, request: AuthzRequest): void {
   const resolved = assertRuntimeAuthorizationBound(runtime)
+  if (resolved.type === "delegated") {
+    throw new AuthorizationError(
+      `delegated:${request.kind}`,
+      `[Sixb] Operation '${request.kind}' is not covered by delegated authorization.`
+    )
+  }
   const authorization = resolved.type === "principal" ? resolved.context : undefined
   const decision = evaluate(authorization, request)
   if (decision.allowed) {
@@ -145,11 +156,18 @@ export function assertAuthorized(runtime: AuthorizedRuntime, request: AuthzReque
   )
 }
 
+/** Runtime catalogs never infer unrestricted access from an absent principal context. */
+export function isRuntimeAllowed(runtime: AuthorizedRuntime, request: AuthzRequest): boolean {
+  const authority = resolveRuntimeAuthorizationForProject(runtime)
+  if (authority.type === "denied" || authority.type === "delegated") return false
+  return authority.type === "unrestricted" || isAllowed(authority.context, request)
+}
+
 /** Resolve registered process-local authority before a protected leaf makes a decision. */
 export function assertRuntimeAuthorizationBound(
   runtime: AuthorizedRuntime
 ): Exclude<ResolvedRuntimeAuthorization, { readonly type: "denied" }> {
-  const resolved = resolveRuntimeAuthorization(runtime.runtimeAuthorization)
+  const resolved = resolveRuntimeAuthorizationForProject(runtime)
   if (resolved.type === "denied") {
     throw new AuthorizationError(
       "runtime:unbound",
@@ -218,27 +236,22 @@ export function assertPrivileged(runtime: AuthorizedRuntime, operation: string):
  * Assert access to process providers that trusted executions and genuine agent runs may use.
  *
  * Agent provenance alone is not authority: the registered capability must be bound to the exact
- * same execution identity and run before this check succeeds.
+ * same immutable execution before this check succeeds.
  */
 export function assertProviderAccess(
-  runtime: AuthorizedRuntime,
+  runtime: AuthorizedRuntime & { readonly runtimeAuthorization: RuntimeAuthorization },
   execution: ExecutionContext,
   operation: string
 ): void {
-  const resolved = assertRuntimeAuthorizationBound(runtime)
+  const resolved = resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization,
+  })
   if (resolved.type === "unrestricted") {
     return
   }
 
-  const binding = resolved.executionBinding
-  const executor = execution.executor
-  if (
-    binding?.type === "agent" &&
-    executor.type === "agent" &&
-    binding.executionId === execution.id &&
-    binding.actorId === executor.actorId &&
-    binding.runId === executor.runId
-  ) {
+  if (execution.executor.type === "agent") {
     return
   }
 
@@ -266,6 +279,8 @@ function deniedMessage(
       return `[Sixb] Principal '${principalId}' is not allowed to append telemetry for object type '${request.objectTypeId}'.`
     case "action.apply":
       return `[Sixb] Principal '${principalId}' is not allowed to apply action '${request.actionId}'.`
+    case "share.manage":
+      return `[Sixb] Principal '${principalId}' is not allowed to manage Share '${request.shareId}'.`
     case "workflow.run":
       return `[Sixb] Principal '${principalId}' is not allowed to run workflow '${request.workflowId}'.`
     case "sync.run":

package/src/authorization/grant-kinds.ts

@@ -17,6 +17,7 @@ export type GrantKind =
   | "edit:object"
   | "append:telemetry"
   | "apply:action"
+  | "share:share"
   | "run:workflow"
   | "run:sync"
   | "run:pipeline"
@@ -35,6 +36,7 @@ export interface GrantUniverse {
   readonly objectTypeIds: ReadonlySet<string>
   readonly datasetIds: ReadonlySet<string>
   readonly actionIds: ReadonlySet<string>
+  readonly shareIds: ReadonlySet<string>
   readonly workflowIds: ReadonlySet<string>
   readonly syncIds: ReadonlySet<string>
   readonly pipelineIds: ReadonlySet<string>
@@ -108,6 +110,11 @@ export const GRANT_KINDS: {
     subject: "action",
     fix: "Add it to 'actions/' or pass it to createSixb({ actions }).",
   },
+  "share:share": {
+    universeKey: "shareIds",
+    subject: "share",
+    fix: "Add it to 'shares/' or pass it to createSixb({ shares }).",
+  },
   "run:workflow": {
     universeKey: "workflowIds",
     subject: "workflow",
@@ -171,6 +178,8 @@ export function grantKindOf(grant: GrantDefinition): GrantKind {
       return "append:telemetry"
     case "apply":
       return "apply:action"
+    case "share":
+      return "share:share"
     case "run":
       return `run:${grant.target}`
     case "observe":
@@ -193,6 +202,7 @@ export function emptyGrantSets(): MutableGrantIndex {
     "edit:object": new Set(),
     "append:telemetry": new Set(),
     "apply:action": new Set(),
+    "share:share": new Set(),
     "run:workflow": new Set(),
     "run:sync": new Set(),
     "run:pipeline": new Set(),

package/src/authorization/index.ts

@@ -10,6 +10,7 @@ export {
   assertRuntimeAuthorizationBound,
   evaluate,
   isAllowed,
+  isRuntimeAllowed,
 } from "./decision"
 export { AuthorizationError } from "./errors"
 export { canViewEvent } from "./event-visibility"

package/src/bootstrap/discovery.ts

@@ -21,6 +21,7 @@ import { isRuleDefinition } from "../rules"
 import { RuntimeError } from "../runtime/errors"
 import { isScheduleDefinition } from "../schedules"
 import { isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition } from "../security"
+import { isShareDefinition } from "../shares"
 import { isSyncDefinition } from "../syncs"
 import { isWorkflowDefinition } from "../workflows"
 
@@ -82,6 +83,7 @@ type DiscoveryModuleKind =
   | "role"
   | "rule"
   | "schedule"
+  | "share"
   | "sync"
   | "workflow"
 
@@ -136,6 +138,7 @@ const definitionDiscoveryRegistry = {
     kind: "membershipPolicy",
     isDefinition: isMembershipPolicyDefinition,
   },
+  shares: { directory: ["shares"], kind: "share", isDefinition: isShareDefinition },
 } as const satisfies Record<string, DefinitionDiscoveryFamily<unknown>>
 
 type DefinitionFromFamily<TFamily> =