Capability grants (request → approve → expire)
Generated from
mcp/patterns.registry.json— do not edit by hand; change the registry and runbun run patterns:build.
Index card — the docs below are the canonical explanation; deep-tier pattern pages additionally carry invariants and emulation notes.
Category: Identity & Access · Tier: light · Risk: low — application-level authorization logic, Postgres-backed
A request-approve-expire workflow where users request a named capability, an admin approves or denies it, and pending requests auto-expire after 14 days.
When to use: Use in place of static roles when access to a feature, such as blog authoring, needs an auditable grant/revoke lifecycle.
Docs
Code
src/lib/server/auth/grants.ts(GitHub · GitLab)src/lib/server/auth/grant-requests.ts(GitHub · GitLab)
Machine-readable record: identity-capability-grants in mcp/patterns.registry.json.