feat(policy): add credential grant authorization package

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81

examples/railiance-platform/policy_fixtures.yaml

@@ -0,0 +1,59 @@
+- id: fixture:credential-grant-allow
+  request: &allow_request
+    id: check:credential-grant-allow
+    tenant: tenant:platform
+    subject: {id: agent:codex/railiance-platform, type: Agent}
+    action: issue
+    resource:
+      id: credential-grant:rapp-postgres/audit-core-runtime
+      type: credential-grant
+      system: railiance-platform
+      attributes:
+        grant_id: rapp-postgres/audit-core-runtime
+        credential_type: openbao-database-credential
+        issuer: openbao
+        audience: audit-core
+        max_ttl_seconds: 3600
+        allowed_actor_types: [human-operator, approved-agent, ci-runner]
+        allowed_purposes: [audit-core-runtime]
+        allowed_delivery_modes: [exec-env]
+    context: &allow_context
+      actor_type: approved-agent
+      bound_subject: agent:codex/railiance-platform
+      purpose: audit-core-runtime
+      delivery_mode: exec-env
+      requested_ttl_seconds: 900
+  expect: {effect: allow, reason: credential_grant_allowed}
+- id: fixture:credential-grant-ttl-deny
+  request:
+    <<: *allow_request
+    id: check:credential-grant-ttl-deny
+    context: {<<: *allow_context, requested_ttl_seconds: 5400}
+  expect: {effect: deny, reason: ttl_out_of_bounds}
+- id: fixture:credential-grant-actor-type-deny
+  request:
+    <<: *allow_request
+    id: check:credential-grant-actor-deny
+    context: {<<: *allow_context, actor_type: unapproved-agent}
+  expect: {effect: deny, reason: actor_type_not_allowed}
+- id: fixture:credential-grant-purpose-deny
+  request:
+    <<: *allow_request
+    id: check:credential-grant-purpose-deny
+    context: {<<: *allow_context, purpose: unrelated-purpose}
+  expect: {effect: deny, reason: purpose_not_allowed}
+- id: fixture:credential-grant-delivery-deny
+  request:
+    <<: *allow_request
+    id: check:credential-grant-delivery-deny
+    context: {<<: *allow_context, delivery_mode: chat}
+  expect: {effect: deny, reason: delivery_mode_not_allowed}
+- id: fixture:credential-grant-unknown-deny
+  request:
+    <<: *allow_request
+    id: check:credential-grant-unknown-deny
+    resource:
+      id: credential-grant:unknown/grant
+      type: credential-grant
+      system: railiance-platform
+  expect: {effect: deny, reason: unknown_grant}