Grant flow
- A human support operator with
support_access.managerequestsdiagnostics.readfor one workspace, a reason, and 15–480 minutes. - A different recently step-up-authenticated human with
members.managein the workspace approves or rejects it. - The requesting operator can read diagnostics only while that exact grant remains active.
- The customer can revoke it immediately; expiry is checked on every read.