Layer child permission rules over parent session policy without dropping root-level grants or mutating shared state.