Accepted access is checked where it is used

Context

A declaration requests access; an installation records what the administrator accepted.

Decision

Persist the administrator’s accepted access and enforce it at each use: capability selection, subscriptions, provider authorization and credential leases. Declared data access remains unimplemented.

Alternatives Considered

Validate access only during installation. Later withdrawal would not constrain subsequent use.

Use the adapter declaration as authorization instead of accepted access. The administrator’s narrower choice would have no effect.

Consequences

Withdrawal pauses affected subscriptions and prevents later bound provider admission.

Reaccepting withdrawn access is currently allowed by implementation despite the narrow-only product decision and remains unresolved.

Data-scope declarations provide no working grant until their service operations are implemented.