Decide access mode preview items

Decide items the switch to delegated mode would change. Keep exempts an item; revoke revokes, deletes or stops it; narrow holds an item listed for a person (suspended or flagged) to be decided on the waiting list, where a key or Function can be narrowed; on an unattributed object, which no reduction holds, narrow leaves it as keep does, and the preview does not offer it. A mailbox loss or a connected app is only acknowledged (keep); a controlled key or Function and a self-given access entry take keep or revoke; another decision is refused with 400. Revoking a filter needs confirm: true. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose access_mode.write (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs access_mode:manage (owners). API keys are refused.