Who may do what, changed by the smallest step

A request about access is usually a sentence about a person and a task: "let Minh fix the models", "Lan needs the raw data until the end of the month", "Sales should see only their dashboard". Undercroft answers it with one of five changes, and the right one is the smallest that covers the task and no more:

1. Give the person a role the customer already has (people.setRole, or people.invite for someone not yet in). A role is a named set of permissions.
2. Define a role of the customer's own (roles.save), when several people need the same set of permissions and no role holds exactly that set.
3. Grant one permission to a role or to one person (grants.save with permission), standing or until a moment, when one person needs one more thing, or needs it for a while.
4. Grant reading one thing (grants.save with object): a model or reference table (model:fct_sales), a raw stream or a whole source (raw:hubspot/deals, raw:hubspot/*), a question or a dashboard (report:question:<id>, report:dashboard:<id>), or the whole of one (model:*, raw:*, report:*).