Function grants 

pub fn grants(
    workspace: &str,
    installation: &str,
    installer: &str,
    rules: &[Rule],
) -> Result<Vec<Grant>, BotRuleError>

The grants installing installation in workspace gives, with installer (a user root, hex) as the grantor: the scoped rules, then the deny on the workspace resource that agent admissions carry too.

Errors

See scoped_rules.