Support Grant Issue

BES staff hold zero authorization in a customer tenant by default. When a customer needs support they raise a request, and this interface issues a time limited, revocable, customer visible grant against it. Nothing here is a silent backdoor login: the whole path is audited and the grant is listed to the customer. Support grants are kept apart from ordinary role assignments because they carry fields ordinary assignments do not, namely request number, approver, reason, scope, expiry and closing time. Snapshot assembly merges the grant with ordinary assignments in one statement, so the authorization path stays single. Expiry is decided when the session snapshot is assembled, not only by a background sweep, because a stalled sweep would silently extend access. The grantee must be active staff; no tenant membership is required or created, because the grant itself admits the staff member to the tenant for the session snapshot; the approver is never the grantee; the role is a preset role of the product; expires_at lies within the configured window; one effective grant per person, tenant, product and project.

POST /internal/control/v1/support-grants