A grant and its five states
c1362026-11-10Purpose, level, scope, window, who, record; none, requested, active, revoked, closed.
Source: c136 initial-prompt.md (Mark's words on c130 D6, 2026-11-09); c136 plan.md §The shape, §Rules R1–R7, D1–D7 (confirmed 2026-11-09), §Patterns (the grant as a story); c130 plan.md D6 ruling; c134 (the plane side), c131 (the Status line), c137 (the grant notice as a message).
one record on the plane (D1); the native app only reads it (D7)
- Purposeone of four categories and the partner's own sentence: "fix the ClickHouse retention bug, ticket 142"
- Levelobserve · operate · change, each said in one sentence (R6)
- Scopethe whole plane, or named parts: one endpoint group, one integration, the database layer
- Windowstart and duration, 1 h · 1 d · 3 d · 7 d at most; expires on its own, revocable at any moment (R2)
- Whothe admin who granted; the Qpoint people admitted by name, never a shared account (R4)
- Recordevery action in the audit log carrying the grant id (access.grant.*, D5); a summary to the admin at close
| Purpose | Observe | Operate | Change |
|---|---|---|---|
| Diagnoselook, change nothing; the investigation before the other three | default | the admin raises | the admin raises |
| Fixa documented problem; a ticket exists | allowed | default | the admin raises |
| Implementa feature the partner asked for | allowed | allowed | default |
| Hot-fixan incident in progress | allowed | allowed | default |
Observe: read configuration, logs, metrics and the audit log. Operate: observe, plus restart services, run shipped migrations, change settings. Change: operate, plus deploy a build or a hot-fix; the shortest default window. The plan fixes diagnose → observe; the other three defaults are this sketch's reading of the level sentences.
the resting state of every plane; a self-hosted plane with no Qpoint reachability simply has no grants (R7)
Qpoint asks, naming the purpose, the people and the least level that does the job; nothing is open yet
the admin granted; the window runs, every action is logged with the grant id and visible live
the admin's one click, immediate; the early exit from active (R5)
the window ended on its own; the admin gets what was done; a renewal is a new grant (R2)
“Qpoint has access to this plane until Thursday 14:00 (fix · operate). 3 actions so far.” Grant, watch live, revoke in one click (R5).
opened · action · revoked · closed, in the same stream as everything else (D5); the opening also goes to the operators as a message (c137)
one line when a grant is active on the plane this endpoint reports to; nothing otherwise. Read-only, with the audit entries (D7).
sees that Qpoint is in, and why; invisible when working
the only one who grants (R1, D2); a second admin for Change, off by default
a named identity (OIDC from Qpoint's IdP) the plane accepts only while a grant names it; an expiring invitation link when the plane cannot reach us (D3). Same API and web app, no back door (D4).
- R1 The partner grants. Qpoint never self-grants and never holds standing access.
- R2 Every grant ends. Short defaults, seven days at most; a renewal is a new grant.
- R3 Least level by default. Diagnose and observe are the defaults; the admin raises them.
- R4 Named people. Each action names the person, never "Qpoint support".
- R5 The partner can watch. Live while it runs, summarised at close; revocation is one click.
- R6 Plain words. Each level in one sentence on the grant screen; no jargon.
- R7 Nothing phones home. A plane that cannot reach Qpoint has no grants.