The single business grade the scenario's primary caller self-assigns at
registration — the role literal placed in its I{Actor}.IJoin body. It
must be one of the access actor's declared grades.
What that grade must produce against the target operation's
authorization.access.roles:
"forbidden": the grade is INSUFFICIENT (neither is nor inherits a
required grade), so the call must be rejected with HTTP 403."allowed": the grade is SUFFICIENT (is or inherits a required grade), so
the call must reach the success path.
Grade-gate proof marker on a AutoBeTestScenario.
Set this only on a scenario that exercises a grade-restricted operation's authorization gate (an operation whose
authorization.access.rolesis non-empty). It pins the single business grade the scenario's primary caller self-assigns at registration (therolevalue in itsI{Actor}.IJoinbody) and the outcome that grade must produce, so the scenario and operation-write validators can deterministically enforce that the negative test really proves a 403 and the positive test really holds a qualifying grade. Leave it unset for any scenario that is not a grade-gate proof.