For applications whose users sign in through GrantForge: asks GrantForge's open API what the signed-in user may do, keeps the answer and revalidates it cheaply, and guards controllers with @RequirePermission. Depends on no other GrantForge module, so applications take only the open API's contract.