- Shipped
- October 19, 2026 at 1:50 AM UTC
- Author
- Kamo
- Commit
- a572f6c
OrderDelegation.resolve takes a CallScope: the tools/list keeps the session lending the requester's whole standing (kamo:tool:order:<runId>), so the SI knows what it may be asked to do; a tools/call on an order mints/uses a session lending ONLY the called tool's needed rights: the rights it requires of a person (allOf and anyOf, the same K3 weighs as RequestContext rightsAllOf/AnyOf) and, for every iot_ tool, VIEW_IOT_DEVICES (IoTService's own gate; the iot tools declare no session rights). SecurityService gets them as neededRights and mints the session even when nothing is borrowed, so its delegation block (requesterMemberId, orderRef) reaches downstream services. Kept per run and tool **************** under the same TTL rules; audit rows keep authorityBasis, onBehalfOfMemberId and borrowedRights.