allowedKeys property
Replacement key filter, applied wholesale rather than merged (the entry's
allowedKeys becomes exactly this value). Omitted leaves the filter unchanged.
Explicit null REMOVES the filter — the subject may once again reach every key
within its scopes, a privilege increase a consumer SHOULD gate like clearing
expiresAt. An EMPTY ARRAY sets the filter to no keys at all — the narrowest
grant, not a wildcard. A replacement that narrows the previous filter IS a
privilege reduction: unlike scopes (whose narrowing is refused here and routed to
acl/revoke) it is accepted, because acl/revoke/0.1 cannot express a per-key
reduction — but the consumer MUST audit it as a reduction and apply it to the
subject's live sessions rather than letting the wider set survive until a
credential expires.
Implementation
final List<String>? allowedKeys;