The agent on whose behalf the search runs, or null for human-driven searches. When set, the agent's SearchScopeAccess column gates the fallback paths.
OptionalContextOptional ContextUser for RunView calls. Server-side code must always
pass this to enforce data isolation; it is the same UserInfo as User
unless the caller is impersonating.
The SearchScope being authorized.
The acting user. Required even when an agent is invoking the search, because agent-mediated calls still authenticate as a user and any direct/role grants on that user ID still apply.
Inputs required to resolve a permission. The resolver is server-side only and never reaches into request context — caller passes the identities it has already established.