skarbiec grant verify

Invocation#

skarbiec grant verify <consumer> <item> --action <action> [--field <field>] --token-file <path>

Purpose#

Check one presented bearer against one exact action, item, and optional field binding.

Required inputs and options#

• Requires exactly a consumer and an item, --action naming the action asked about (no action is assumed), and --token-file, an owner-only file holding the bearer; field-scoped actions use --field.

Output and state effects#

• Prints consumer, action, item, field, and allowed boolean. It does not change the grant.

Refusals#

• A missing --action, a consumer or item missing or followed by another positional, --token (refused naming --token-file), and a missing or unsafe token file are refused. Unknown, expired, malformed, wrong-audience, wrong-action, wrong-item, wrong-field, and mismatched bearers all produce allowed false rather than broadening scope.