Access diagnostics
Ask the server what it would decide, and why. Nothing on this screen grants, revokes or changes anything.
Note: This is the server's decision, not this console's opinion
The answer below comes from the same evaluator the real request path uses, decided under the policy epoch it names. It is a simulation in the sense that no request is served — it is not an approximation of the rules.
What to ask
The staff id whose access you are asking about. Their directory entry carries it.
For example staff.customers.read or staff.permissions.assign.
"self" asks about their own record; anything else is decided against the organization or case below, or against the platform when neither is given.
Leave empty to decide against the platform rather than one customer.
A support case narrows the decision to that case's scope.
The what-if. The evaluator decides as though this person also held that version, so a proposed grant can be checked before it is requested.
A staff member and a capability are both required. There is no default: a simulation of an unnamed question would answer a different one.