how to grant limited authority to save contract upgrade materials?

[dckc]

What is the Problem Being Solved?

In a permit for a core-eval, we have items such as contractKits and zone that can be used to store adminFacet durably. But they also grant access to all creator facets of all other contracts. In order to save privateArgs, we can use instancePrivateArgs, but that grants tremendous authority as well.

Description of the Design

TBD

@michaelfig and @turadg have kicked around some ideas.

Security / Upgrade Considerations

This is all about granting the least authority that a core-eval needs in order to preserve materials for later upgrade.

Scaling Considerations

not much

Test Plan

?

[dckc]

potential solution permits that attenuate collections such as instancePrivateArgs

 "instancePrivateArgsPart": {
    "myContract": true
  }

cc @raphdev

[dckc]

In #8786, I just added:

Read/write access to the whole vatStore is excess authority; we only need access to read one of its entries, not authority to scribble over all the others and upgrade all the other vats.

I expect proposals to upgrade non-contract vats to only come from Agoric OpCo for the forseeable future, so that seems less risky than things like contractKits and instancePrivateArgs.

cc @raphdev