Function op_level 

pub fn op_level(kind: &OpKind) -> Level

The grant strength an op needs over the scopes op_scopes names.

Write for everything that moves a ref or changes a review’s shape, and read for the ops that only report what their own signer thinks: a verdict, a comment, a viewing receipt (D55), and a vouch or its withdrawal (D65).

Those are exactly the ops admission binds to the signing channel — a claimed attribution other than the channel is reviewer_mismatch — and the fold refuses a verdict from anybody the review does not list. Read is therefore the whole authority they need, and requiring write would mean handing push rights to every reviewer drawn onto a repository, which is the opposite of what asking for a review is for.

A vouch joins them for the same reason and one more. It is node- scoped, so write here would mean node-wide write: the web of trust would be authorable only by the handful of identities who can already move any ref on the node, which is not a web. What stops it being free is not this level but View::is_bound_operator — both ends of an edge need a binding, and only the node authors those.

Exhaustive on purpose, like op_scopes: a new OpKind variant will not compile until somebody says which side of this line it falls on, and the safe answer is write.