ResourceGrantBody

Mint/update a kb_access_grants row on a resource. Principal {kb_teams,kb_profiles}.
The DB coherence CHECK enforces write|delete|grant ⇒ read; pass a coherent set
(a write grant implies read).

{
    "can_delete": true,
    "can_grant": true,
    "can_read": true,
    "can_write": true,
    "principal_id": "b0fe3bdd-8201-445a-aab3-a018692d6aca",
    "principal_table": "string"
}