Inspect what an authorized Cosmos executor can send
Permission to execute messages on behalf of another account can carry denomination and recipient limits. An address appearing as a grantee is only the start of the check.
Filter by parties and message type
Set OWNER to the authorizing address, EXEC to the executor and GRPC to a TLS gRPC endpoint with reflection. Query the bank-send grant and inspect the concrete authorization type and its expiration.
grpcurl -d "{\"granter\":\"$OWNER\",\"grantee\":\"$EXEC\",\"msgTypeUrl\":\"/cosmos.bank.v1beta1.MsgSend\"}" "$GRPC" cosmos.authz.v1beta1.Query/Grants
For a SendAuthorization allowing 500 uatom, an attempted spend of 600 uatom exceeds the remaining limit. A generic authorization for the same message type has a different scope. Inspect an allow list when the concrete type provides one.
Separate authority from payment
An authz grant does not by itself provide a fee allowance or replenish the owner’s account. Verify the fee payer and available funds separately. The chain checks authorization again when executing the message. github.com Cosmos SDK Query API