X_PERMISSION_BORROWED

an app rule requires a permission only an imported package declared

an action, query or route the app declares requires a permission that only a package it imports declared — @ultimat3/admin's defineAdmin() declares <entity>:read|write|delete for every mounted entity — so the app's own definePermissions() never names it and the rule holds only in a process that ran defineAdmin() first: a worker role, a script or a test that never mounts the admin throws X_PERMISSION_UNKNOWN at the rule's can()

x verify --only policy --json