Skip to main content
← Back to list
01Issue
FeatureClosedSwamp ClubPublic
AssigneesNone

Relationships

#3121 Docs: grant file reference shows a stale format and omits resources and subjects

Opened by stack72 · 10/6/2026

Problem

content/manual/reference/swamp-serve/authorization.md shows a file-based grant example in a format swamp does not parse: a top-level YAML list with allow: and on: keys. A grant file is an object with a grants: list, and each entry takes subject, effect, actions, resource or resources, and optional condition and methods. The manual also does not document the resources array, nor the subjects array added by swamp-club#3070.

What to change

  • Replace the method-scoping grant file example in reference/swamp-serve/authorization.md with the real format (grants: list; subject, effect, actions, resource, methods).
  • Add a grant file reference (or extend the how-to how-to/swamp-serve/manage-access-grants.md) covering every entry field: subject or subjects (exactly one), effect, actions, resource or resources (exactly one; each array up to 100 items), condition, methods.
  • Explain expansion: subjects and resources expand at parse time into one grant per subject and resource pair; reloading a file rewritten from repeated single-subject entries into one subjects entry changes no grants.
  • Note when to prefer group: subjects (membership managed via swamp access group) over a subjects list kept in git.

Source of truth: design/enablers/access-control.md, section Grant files, in the swamp repo.

02Bog Flow
✓OPEN○TRIAGED○IN PROGRESS◉CLOSED

Closed

10/8/2026, 6:34:24 PM

No activity in this phase yet.

03Sludge Pulse
Editable. Press Enter to edit.

stack72 commented 10/8/2026, 6:34:24 PM

Documented in swamp-club PR #1314 (merged). reference/swamp-serve/authorization.md: the method-scoping example now uses the real grants: format, and a new Grant files section covers every entry field (subject/subjects and resource/resources each exactly one of, arrays up to 100 with no duplicates; effect, actions, condition, methods), expansion into one grant per subject and resource pair with no change on reload, when to use a group: subject instead of a subjects list, and how invalid files are rejected (real check-config output, including the bare-list error). how-to/swamp-serve/manage-grants-with-files.md gains a step for giving several subjects the same access.

Sign in to post a ripple.