Permissions answer the who of a capability invocation; the execution-environment answers the where. A subject holds permission to call a capability by virtue of one or more capability-grant objects — granted directly, via an org role, or via team membership. Every denial is recorded by audit-log-api and can be read back through the shell:audit.read@1 capability. Permissions are immutable per grant; revocation produces a new grant with a revoked state — no in-place mutation.