RUNNING

Grant

A Grant as RunningLake's configuration repository declares it, at policies/grants/<name>.yaml. Generated from the Go types the control plane decodes this file into, so it checks the shape the gate reads — field names and types, and which fields may exist. The gate also applies rules no schema can express — required fields inside spec among them — so a file this schema accepts can still be refused by `rl diff`. Take #/properties/spec for the spec alone.

File: policies/grants/<name>.yaml

Fields

Field	Type	Required	Meaning
`apiVersion`	string	Yes	The config schema's version, which is independent of the HTTP API's (rule unsupported-api-version). Values: `runninglake.io/v1alpha1`
`kind`	string	Yes	The kind this file declares. A kind that disagrees with the file's path is refused (rule kind-mismatch). Values: `Grant`
`metadata`	object	Yes	No description
`metadata.name`	string	Yes	The resource's name, which is also its path segment. It must be the name this file's path gives it (rule name-mismatch).
`metadata.labels`	map of string	No	No description
`metadata.annotations`	map of string	No	No description
`spec`	object	No	No description
`spec.principal`	string	No	Principal is "<kind>:<value>": user:<email>, role:<one of the five roles>, or team:<name>. A team: principal matches NOBODY until teams exist — a grant that cannot be resolved hides rather than reveals.
`spec.privileges`	array of string	No	Privileges is a closed set: select, all, bulk_read. Lowercase. `all` means the four data privileges and never bulk_read; insert, update and delete are refused on their own, because the catalog has one relation for writing, and it also lets the holder drop a table, so a single write privilege would be granted wider than it reads. bulk_read lets the principal obtain one short-lived, read-only storage credential over the whole layer, every table in it including tables nobody has classified yet, with the layer's file volumes denied. It is granted only by name, and only on a layer: a grant of it that names a schema or a table is refused.
`spec.on`	object	No	On is the target, STRUCTURED rather than dotted: a string that has to be split is a namespace derived two ways.
`spec.on.layer`	string	No	No description
`spec.on.schema`	string	No	No description
`spec.on.table`	string	No	No description

A nested field is written with its parents, spec.a.b; an item of a list is [] and a value of a map is *. Required means the parent object must carry the field; the rules a schema cannot express, such as a field that is required only inside spec, are checked by rl diff.

The schema

This page is read from the kind’s published schema, at https://runninglake.com/schema/v1alpha1/grant.json. An editor that follows it checks a file of this kind as you type. To see the fields of a kind’s spec from the command line, run rl schema with the kind’s name: it works offline and prints what the gate accepts. The command reference has the rest.

All kinds