Access decisions
Assignments, grants, and effective access.
The canonical access chain is:
License → Assignment → Grant → Effective Entitlement
A License is the commercial capability and capacity source for an Organization. An Assignment identifies the external user consuming one seat. A Grant records why that external user receives a particular Entitlement. An Effective Entitlement is an optimized authorization projection derived from valid Grants; it is not an independent source of product rights.
Canonical access requires at least one currently valid Grant. License validity, revocation, and seat release can change which Grants count. If one path disappears, another valid path may still authorize the same Entitlement.
Your backend authenticates its own user, obtains its stable external ID, and calls check effective access with that ID and the Entitlement key. The machine API key authenticates your backend to BusinessMode; it does not authenticate the customer user.
Review Licenses and Members & seats when an allocation appears in management but hasAccess is false.