Rename the coarse gate from role to permission, matching RBAC

ory/keto/keto.yml

@@ -1,4 +1,4 @@
-# Ory Keto — authorization (ReBAC), the source of truth for roles/groups and the rare
+# Ory Keto — authorization (ReBAC), the source of truth for permissions/groups and the rare
 # fine-grained check (README: three tiers of "may I?"). The permission model lives in
 # namespaces.keto.ts (OPL); DSN comes from the env (the per-service keto DB). The web
 # app never connects directly — it calls the read (4466) / write (4467) APIs, the ports

ory/keto/namespaces.keto.ts

@@ -7,26 +7,27 @@ import { Context, Namespace, SubjectSet } from "@ory/keto-namespace-types"
 // A Kratos identity. Subjects are written as `identity:<kratos-identity-id>`.
 class Identity implements Namespace {}
 
-// A subject set: a named collection of users (and nested groups), resolved transitively.
-// The admin "Groups" screen manages membership; checks expand it automatically.
+// A named set of identities (and nested groups), resolved transitively. The admin "Groups"
+// screen manages membership; checks expand it automatically.
 class Group implements Namespace {
   related: {
     members: (Identity | SubjectSet<Group, "members">)[]
   }
 }
 
-// A coarse role — the source of truth for the JWT `roles` claim. At login the app reads
-// `Role:<name>#members@identity:<id>` from Keto and projects the result into the token
-// (README: Login → session JWT). A group can hold a role, so members can be users or groups.
-class Role implements Namespace {
+// A coarse permission — an operation a route or menu item gates on, and the source of truth
+// for the JWT `permissions` claim. At login the app reads `Permission:<name>#granted@identity:<id>`
+// from Keto and projects the result into the token (README: Login → session JWT). A group can
+// hold a permission, so grants go to an identity or to a whole group.
+class Permission implements Namespace {
   related: {
-    members: (Identity | SubjectSet<Group, "members">)[]
+    granted: (Identity | SubjectSet<Group, "members">)[]
   }
 }
 
 // A fine-grained, relationship-checked resource — README's third "may I?" tier, the rare
-// live Keto check (e.g. sharing/delegation). Permissions nest: owner ⊇ editor ⊇ viewer.
-// Grants accept a user directly or any member of a group.
+// live Keto check (e.g. sharing/delegation). Permits nest: owner ⊇ editor ⊇ viewer.
+// Grants accept an identity directly or any member of a group.
 class Resource implements Namespace {
   related: {
     owners: (Identity | SubjectSet<Group, "members">)[]