OptionalauthorizeApplication-owned context schema evaluated after official action validation.
OptionaldestructiveDestructive rules require an approval callback before execution.
Store, adapter, or transport operation.
Exact official action name. Wildcards are intentionally unsupported.
Tenant/scope/resource authorization. Absence means deny.