Variable: PERMISSION_CODES

const PERMISSION_CODES: readonly ["subject.create", "subject.read", "person.create", "person.read", "grant.create", "grant.read", "grant.revoke", "accreditation.apply", "accreditation.admit", "accreditation.publish", "accreditation.read", "entity-statement.read", "identifier.create", "identifier.read", "identifier.publish", "identifier.update"]

Defined in: packages/contracts/src/authorization.ts:12

What an actor may do inside the scope a grant confers (slice 1 D1.8). A closed set, so a bundle that names a permission nobody defined fails validation at the boundary, and a handler's check is a function over these codes in packages/authz, never over a claim the identity provider issued.

Named PERMISSION_CODES because PERMISSIONS is already the broker's permission table (permissions/table.ts), which is a different thing.