Write who can see what, once.
Named rules you attach to tables, files, flows and routes, checked on every request.
Everyone gets a different list.
Lists only return the rows a caller may see, filtered in the database, so pages and counts stay correct.
owner-only One rule, five places. Change it once and they all follow.
As simple or as deep as you need.
Start from the common cases, or group your own conditions.
- Different rules for listing, reading, creating, editing and deleting
- Roles, from admins to guests
- Let people work with only their own records
- Tell users apart from services and agents