The agent on whose behalf the search runs, or null for human-driven searches. When set, the agent's SearchScopeAccess column gates the fallback paths.
OptionalContextOptional ContextUser for RunView calls. Server-side code must always
pass this to enforce data isolation; it is the same UserInfo as User
unless the caller is impersonating.
OptionalHostTrue when the run's HOST assigned this scope (RunActionParams.RunScope.SearchScopeIDs). The host's assignment
then stands in for the agent's own access: its SearchScopeAccess='None' and its assigned-scope list do not
refuse. It never grants — the user still needs a direct or role grant (or the agent's existing 'All' fallback),
and a skill's rules apply as always.
OptionalPrimaryTenant this search is running for (SearchContext.PrimaryScopeRecordID). When supplied, a
grant that carries its own PrimaryScopeRecordID applies only to that tenant. Grants with a
NULL tenant continue to apply everywhere, so existing rows are unaffected.
The SearchScope being authorized.
OptionalSkillThe skill on whose behalf the search runs, or null. A skill is a PRINCIPAL in exactly the
same sense an agent is: AISkill.SearchScopeAccess plus MJ: AI Skill Search Scopes rows
let activating a skill reach a scope the user's own roles do not grant. Optional so every
existing caller compiles and behaves unchanged.
The acting user. Required even when an agent is invoking the search, because agent-mediated calls still authenticate as a user and any direct/role grants on that user ID still apply.
Inputs required to resolve a permission. The resolver is server-side only and never reaches into request context — caller passes the identities it has already established.