Variable: STREAM_DECLARER

const STREAM_DECLARER: "bootstrap"

Defined in: packages/contracts/src/permissions/table.ts:409

The participant that declares every stream and its consumers, at setup time: bootstrap, the one-shot setup runner, whose nkey is mounted in no long-running container.

A stream stores whatever subjects it is configured to capture, and the broker does not check the capture against anybody's subscribe permissions. So whoever may create or update a stream can capture another principal's replies (_INBOX.gateway.>) or every request (request.>) and read them back through a consumer. That grant therefore belongs to a principal that runs once and then exits, not to the service that reads the stream every second. The reader checks the configuration when it starts and refuses to run on one that differs, and the setup principal holds no grant to read a stream's messages.