Enumerate every (app, mount) grant the user holds — the audit view (§8.11). Elevated.

Capability: spaces:admin. Catalog name: spaces:grants.

Error & { code: ListGrantsError } on host refusal.