A grant derived from a live session's precomputed space access. There is no space field (always the queried space), no propagated/source field (the snapshot is flattened at login), and no binding (nothing revocable except the sessions themselves).