Move grant constraint definition back into let