"""Core-owned provider grants; independent of generated-app identity."""