giles fe47334e52 acl: Phase 1 direct grants + deny-overrides, 24 tests ...

Datalog ACL layer (schema/facts/engine/api) over lib/datalog/. Direct
grant permits unless explicit deny names same (S,A,R) — deny-overrides
via stratified negation. Conformance wrapper + scoreboard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-06 16:32:13 +00:00

5.6 KiB

Raw Blame History

View Raw