keys property
Replacement key scope, applied wholesale. Omitted leaves it unchanged. {"scope": "all"} lets the subject reach every key within its act scope again — a privilege
increase a consumer SHOULD gate like clearing expiresAt; {"scope": "none"}
removes every key; listed states the exact set. There is no null form. A
replacement that narrows the stored key scope IS a privilege reduction: it is
accepted here, because acl/revoke/0.2 narrows only the act scope, but the consumer
MUST audit it as a reduction and apply it at the subject's next authorization
decision.
Implementation
final KeyScope? keys;