Interface AttestationGrant

Audiences the subject may create sessions for. undefined = unrestricted; [] = deny all (fail-closed).

Exact scope strings the subject may request. Wildcards are NOT supported here — only subNamePatterns supports wildcards.

Maximum session TTL (seconds) the subject may create. Must be a finite positive number.

Permitted child (SubHandle) names. Only meaningful on Identity→Handle attestations. Each pattern is either an exact name or ends with a single trailing * (prefix match); a lone * matches everything. Patterns like a*b are rejected at issue time.