Caller guard: the single actor (and the grades within it) allowed to
invoke this operation, or null for a public endpoint that needs no
authentication.
Reusable authorization state mutated by this operation for some target
actor (approval or role grant), or null when the operation changes no
reusable authorization state.
Auth-lifecycle state this operation creates or renews, or null when the
operation performs no join/login/refresh lifecycle action.
Complete authorization contract attached to every IOperation.
The three facets are orthogonal and each independently nullable, so a single operation can simultaneously establish an auth-lifecycle state, guard its own access, and mutate another actor's reusable authorization state. A fully public operation has all three set to
null.