An environment grant is a typed authorization row that says "subject S may execute capabilities in environment E." authorization-api checks that the caller holds an environment grant for the active execution environment before dispatching, and the environment's reach ceiling then caps what the capability may touch. Environment grants are revocable, auditable, and can be issued at any space. They are the mechanism that lets Xema trust biomes incrementally — a third-party biome may default to the sandbox environment and require an explicit grant to run in org or project.