Description: Given a specific access decision — a grant or a denial — shows the relationship chain that produced it, both for self-service understanding ("why can't I reach this machine?") and for audit purposes. Displayed inline on the decision itself, not as a separate batch report.
Acceptance criteria:
- A denied access attempt can show the relationship chain (or lack thereof) that led to denial
- A granted access can show the relationship chain that authorized it
- Fast enough to render inline on the access-denied response
Description: Given a specific access decision — a grant or a denial — shows the relationship chain that produced it, both for self-service understanding ("why can't I reach this machine?") and for audit purposes. Displayed inline on the decision itself, not as a separate batch report.
Acceptance criteria: