ScopedAccessPolicy

The access policy over scoped grants: the effective level for a call is the highest level among the grant entries that cover the call's target, and the call passes when that level includes the verb's minimum.

A pod entry covers everything. A resource entry covers its IRI and, for a container, the subtree. A module entry covers the module's verbs and the containers moduleRoots reports for it, which are only resolved when the grant holds a module entry. A denial names what the caller holds and what the verb needs, so a developer can see which scope to ask for.