Interface CanRequirement

端点授权声明的可信形状：一对 (action, subject)。

interface CanRequirement {
    action: "create" | "read" | "update" | "delete" | "cancel";
    subject:
        | "Organization"
        | "Member"
        | "Invitation"
        | "Workspace"
        | "Role"
        | "RoleGrant";
}