Who manages an access grant.
Created and owned by a customer.
Provisioned and owned by the service. Cannot be deleted by customers.