ResourceBinding · Agent Work Model

Purpose

Attach a Resource to one WorkSession with a narrowed grant, leaving the Resource's native authority intact.

Name	Target	Kind	Cardinality	Inverse
`work_session`	WorkSession	binds	`1`	`resource_bindings` 0..*
`resource`	Resource	references	`1`	`bindings` 0..*

Initial proposed. Terminal: revoked.

proposedboundrevoked

MUST session-specific: A ResourceBinding MUST belong to exactly one WorkSession.
MUST policy-narrows: A binding grant MUST NOT exceed the WorkSession or Project policy.
MUST NOT not-resource-authority: A ResourceBinding MUST NOT claim mutable authority over the Resource.
MUST NOT no-credentials: A portable binding MUST NOT serialize credentials.

None.

Resource: The resource exists independently of any one session binding.
Workspace: A Workspace may be the bound resource; the binding is the grant, not the environment.

Granting a WorkSession read-only access to a named repository at a pinned locator.

Copying the repository's mutable metadata into the session as a second source of truth.

The identity field is the index of the handle. fields is the exchange shape.

Name	Kind	Type	Portable	Notes
`resource_binding_id`	identity	name	True
`work_session_id`	reference	name	True
`resource_id`	reference	name	True
`grant`	policy	Grant	True	Must be a narrowing of session and project policy.
`resolved_locator`	reference	string	True	How this session locates the resource. Not a credential.

System	Native term	Fidelity	Notes
`project-interop`	_none_	tbd