Add resource access explanation contract

src/govoplan_core/core/access.py

@@ -85,6 +85,9 @@ AccessProvenanceKind = Literal[
     "identity",
     "account",
     "tenant_membership",
+    "resource",
+    "owner",
+    "share",
     "organization_unit",
     "function",
     "group",
@@ -496,6 +499,20 @@ class ResourceAccessService(Protocol):
         ...
 
 
+@runtime_checkable
+class ResourceAccessExplanationProvider(Protocol):
+    def explain_resource_provenance(
+        self,
+        session: object,
+        principal: PrincipalRef,
+        *,
+        resource_type: str,
+        resource_id: str,
+        action: str,
+    ) -> Sequence[AccessDecisionProvenance]:
+        ...
+
+
 @runtime_checkable
 class AccessExplanationService(Protocol):
     def explain_scope_provenance(

src/govoplan_core/core/files.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from typing import Protocol, runtime_checkable
+
+from govoplan_core.core.access import ResourceAccessExplanationProvider
+
+
+CAPABILITY_FILES_ACCESS = "files.access"
+
+
+@runtime_checkable
+class FileAccessProvider(ResourceAccessExplanationProvider, Protocol):
+    """Resource-level access explanation provider for Files-owned resources."""