Function is_legacy_administrator_grant 

pub fn is_legacy_administrator_grant(workspace: &str, grant: &Grant) -> bool

Whether grant is an administrator’s grant of workspace in the shape workspaces held before administrator_grant: the owner’s lasting Allow on the workspace’s resource, where it decides nothing an Editor’s role does not already deny. Anything else under the id (a Deny, an expiring grant) is not one, so rewriting never widens it.