The grant that can't say everything

The security review asks what's exposed. On most stacks, the honest answer is a diagram, three config files, and a person who remembers.

On Hoody the answer is the grant document, and the grammar is on your side. A raw-port grant must name its ports: "http": true is rejected with a validation error, a range wider than 16384 ports is rejected the same way, and the ports of Hoody's own core services are refused outright, even buried inside a range. There is no way to write "everything." Default deny closes whatever the document doesn't say.

The reviewer reads a short JSON file whose worst case is a bounded list of numbers.