Function createGrants

createGrants(options: GrantsOptions): KernlGrants
User-facing grants over kehto's ACL state.

kehto's runtime defaults to a permissive ACL (D-001), so kernl writes the complete capability set for every applet it runs: the baseline domains plus what the user allowed are granted, everything else is revoked explicitly. The per-identity record is persisted at kernl:grants:v1; the ACL itself is persisted by kehto. Blocking an applet blocks it in the ACL and empties its environment through createEnvironmentResolver.
Parameters
- options: GrantsOptions
  ACL container, storage and the live domain list.
Returns KernlGrants
The grants surface.
Example
```
const grants = createGrants({ acl: bridge.runtime.aclState, storage, availableDomains });
grants.allowDomain(identity, 'relay');
grants.get(identity)?.capabilities; // includes 'relay:read' and 'relay:write'
```