Function device_panel 

pub fn device_panel(workspace: &str, granted_by: Subject) -> Grant

The grant letting the device’s panel, DEVICE_PANEL, read what the session publishes for it in workspace: the readings of its own resources that are nobody else’s to read, such as what the person copied. It reads them, and nothing about them: changing the device stays the person’s.