skarbiec grant verify

Invocation#

skarbiec grant verify <consumer> <item> [--action <action>] [--field <field>] --token <bearer>
# owner-only file instead of argv: skarbiec grant verify <consumer> <item> --field <field> --token-file <path>

Purpose#

Check one presented bearer against one exact action, item, and optional field binding.

Required inputs and options#

• Requires consumer, item, and exactly one of --token or --token-file. --action defaults to read; field-scoped actions use --field.

Output and state effects#

• Prints consumer, action, item, field, and allowed boolean. It does not change the grant.

Refusals#

• Refuses both bearer sources at once, neither of them, and an unsafe token file. Unknown, expired, malformed, wrong-audience, wrong-action, wrong-item, wrong-field, and mismatched bearers all produce allowed false rather than broadening scope.