Grants
A grant is the list of actions and where they apply. The website, the API, the command line, and MCP all call the same operations, and PostgreSQL enforces the data access. ADoor does not cache a grant. Each request reads the live chain. A grant has no expiry of its own. effectiveExpiresAt is the earliest of the connection's expiresAt, each ancestor connection's expiresAt, the access credential, and a browser sign-in when that call has one. An OAuth access token lasts 1 hour and is refreshed.
A child cannot receive more than the connection that created it has right now. Narrowing or revoking a parent takes effect on the next request. Data already written stays. Leaving the permissions out stores an empty grant, so that identity can do nothing with tables.
What a grant can reach
Each person, app and agent gets its own access, down to a space, a table, specific fields, or just the entries that match a value you choose, and Postgres enforces it on every request. An entry limit is one field equal to a fixed value, for example Client is Calder. It is not a range, and not a rule that changes with whoever is signed in, so to limit each client to the entries with their name, give each client a grant with their own value.
Membership records that a person belongs to the workspace. It is not a second permission system. What they can do is still a grant.