-- Pure claim relationship checks. Unknown roles/actions and ambiguous overlaps deny.
return function(claims, access)
	local function owner_at(pos)
		local found
		for owner, center in pairs(claims) do
			if math.abs(pos.x - center.x) <= 12 and math.abs(pos.z - center.z) <= 12
					and math.abs(pos.y - center.y) <= 24 then
				if found and found ~= owner then return nil, true end
				found = owner
			end
		end
		return found, false
	end

	local function role_at(pos, name)
		local owner, ambiguous = owner_at(pos)
		if ambiguous or not owner then return nil end
		if owner == name then return "owner" end
		return access[owner] and access[owner][name] or nil
	end

	local function allowed(pos, name, action)
		if type(pos) ~= "table" or type(pos.x) ~= "number" or type(pos.y) ~= "number"
			or type(pos.z) ~= "number" or type(name) ~= "string" or name == "" then return false end
		action = action or "build"
		if action ~= "build" and action ~= "dig" and action ~= "use"
			and action ~= "storage" and action ~= "arrival" and action ~= "combat" then return false end
		local owner, ambiguous = owner_at(pos)
		if ambiguous then return false end
		if not owner then return true end
		if owner == name then return true end
		local role = access[owner] and access[owner][name]
		if role == "resident" then return action ~= "arrival" and action ~= "combat" end
		if role == "storekeeper" then return action == "storage" end
		return false
	end

	return {owner_at = owner_at, role_at = role_at, allowed = allowed}
end