IAM Contract
link-iam-contract is where a machine keeps its roles and who holds
each, as every program that gives or reads one finds them, and the
question lnk iam asks to name an agent by its ID.
The roles' file
A machine's roles are one file, ~/.lnk/iam/roles.toml (mode 600),
which path gives: a link_iam::Roles, each role a Policy Spec by its
name and who holds it. Only lnk iam role writes it, through update,
which holds the lock beside it (roles.lock) and writes nothing when
its change fails.
Reading it
read gives the roles, none when there's no file yet. of gives the
roles one principal holds, for link_iam::Principal::with_roles, and
none when the file can't be read: a broken file never widens what a
principal reaches. The way in reads it for each teammate's message, so
a role taken back is refused at the next one.
Naming an agent by its ID
AGENT, the question iam.agent, asks the plugins that keep agents
for the ID of the agent of a name: here with its ID, unstarted for
one without an ID yet, or none. A role is given to agent:<its ID>,
and a grant on agent:<name> is kept as on its ID, so renaming an
agent never moves a grant.