Grant access
Idempotent on (knowledge_base_id, principal_type, principal_id): re-granting updates the role (200) instead of
duplicating. Requires admin+ (or owner).
Authorizations
User session JWT or instance API key (iak_*). Send as Authorization: Bearer <token>.
Path Parameters
Knowledge base id. Legacy physical prefix vs_ (the kb_ rename is deferred).
128^vs_[A-Za-z0-9-]+$Body
Response
Existing binding updated.
Per-knowledge-base access binding, persisted in the
platform-managed product_bindings store (storage owns no
bindings collection). Principals: user, group, org, and
agent - agent ownership is first-class (§F-6). The owner
appears as an explicit role: owner binding; admin / editor
/ reader are grantable via the API (owner is not).
knowledge_base.access_binding ^vs_[A-Za-z0-9-]+$user, group, org, agent 128owner, admin, editor, reader Resolved at read time for user principals.