Time-limited, policy-constrained budget delegation. Dataclass: grantor, grantee, amount, expiry, attached ShieldPipeline constraints. Grant lifecycle: request -> approve -> use -> report -> expire/revoke.