Function administrator_grant 

pub fn administrator_grant(
    workspace: &str,
    person: &str,
    granted_by: Subject,
) -> Grant

The grant that makes person an administrator of workspace, given by its owner granted_by: every governance action allowed, on governance_actions.

An administrator stays a member with a role, an Editor as the workspace’s governance writes them, and that role still bounds them: an invite or a role they hand out is never above it (crate::Refusal::AboveActorRole), a membership action reaches only those ranked below it (crate::Refusal::NotBelowActor), and a grant they give never exceeds what they hold (crate::Refusal::AboveActorGrant). A ban or a live restriction on them stops their governance with the rest of their changes (crate::WorkspacePolicy::check_action).

Workspaces written before the grant took this node held it on workspace_resource, where the Editor’s own Deny at the same node outranked it; is_legacy_administrator_grant finds those so a member’s governance operation rewrites them.