Interface ScopeExplanation

Free-text notes from resolution (discards, applied defaults, expansion-query detail).

Every declared dimension with its resolved value and provenance. Empty for an undeclared scope.

The entitlement decision, or null when this layer did not evaluate one.

null is a real and common state, not a placeholder: SearchEngine does not gate scopes on SearchScopePermission itself — the caller that selects which scopes to search does (the agent RAG layer, an application action). So an explanation captured during a search legitimately has no entitlement to report, while one produced by ExplainScope() always does, because the dry run resolves it on purpose.

It is nullable rather than defaulted because the two plausible defaults are both wrong: a fabricated "allowed" makes an unevaluated search look authorized in an audit log, and a fabricated "denied" makes a perfectly normal search look blocked. Neither is worth the convenience of a non-null field.

True when this scope would actually contribute results: entitlement did not deny it AND at least one lane is active. When Entitlement is null, this reflects the lanes alone.

Entitled-but-zero-active-lanes is the case worth surfacing on its own. It looks like a permissions problem to whoever reports it ("I have access but get nothing"), while the actual cause is every lane failing its filter guard — a configuration bug that an entitlement check alone will never reveal.

The effective context after resolution — what the lane templates were rendered against.

True when this scope configures no lanes at all, which in MJ means UNSCOPED — every provider reads an empty child configuration as "all entities, all indexes, no filter".

Surfaced as its own flag because it is the finding a reviewer is most likely to be hunting for and least likely to spot: such a scope has no filter to inspect, so it looks innocuous in every other field. It is also the exact opposite of what an empty Lanes array intuitively suggests.