7. No escalation; `access.delegation:any` for administrators

Context

Delegated administration (HR assigns managers in their units) must not let anyone grant more than they hold. But the first administrator holds only access.* permissions and must still hand out product roles.

Decision

Granting or revoking needs the actor to cover every effective grant (global covers all; self needs self or global; prefix needs the same scope with the target inside the actor's path; set needs every expanded ID). Role editing needs each added permission globally. Nobody assigns roles to themselves. The built-in access.delegation:any permission (sensitive, global only, held by access_admin) lifts the coverage rules but not the others (self-assignment, reasons, break-glass limits, last admin).

Consequences

• Access admins administer; everyone else delegates within their own reach.
• Granting access_admin needs a reason (it carries a sensitive global permission) and is logged as high severity.
• Group mappings with prefix scopes need global coverage because members are unknown when the mapping is made.