GRANT blocks
A GRANT step must offer a real access-granting control (REJ-24), and the bid must state what / why / scope / until (REJ-11). r104: no legitimate step ever collects a password, one-time code, or session token — grants flow through platform lanes.
grant_access
answers GRANT Person grants a scoped capability the platform can broker. The grant is recorded with its scope and end date; equivalent-swap lets the agent substitute a same-shape path without re-asking.
Grant: read your public event calendar
What: read-only calendar feed · Why: to find open slots · Scope: free/busy only · Until: deal ends
Rules what/why/scope/until required at bid time (REJ-11).
connect_account
answers GRANT Person connects an external account via OAuth-style flow. The person authenticates with the provider directly; the agent never touches credentials.
Connect your Google Calendar
You will be sent to Google to approve. The agent never sees your password (r104).
Rules The provider lanes themselves (Google, automation platforms, ad accounts) are the main GAP — see use cases 3, 6, 7.