Function session_app 

pub fn session_app(workspace: &str, granted_by: Subject) -> Grant

The grant making the desktop session’s own app, SESSION_APP, one of the person’s own apps in workspace: whatever the person may do there, it may do for them. It never reaches past the person it acts for, whose authority bounds every delegation.