The permissions report

Policy is written beside each entity, so nobody has to keep a central copy. To see the whole app at once, read the report jadpo check writes: build/report/permissions.md, with a .json twin. It says who can do what to every entity and field, and which actions and queries are listed separately. Each list is shown as written, and an effect nobody is granted says so.

Here is part of the report for Policy, end to end:

Belongs to a Company through company_id. Only an action listed under actions: changes company_id.

A field that narrows its entity's grants gets a row of its own beside "the record". For the Project under Field restrictions:

An audited entity's line says how long each change is kept in its history, which its history shows to those who may read the record (Audit trail).

When a change alters this table, the approval report shows it in plain terms, such as "CompanyRole.viewer can now read work.Project.budget" (Reviewing a change).

Policy adds no index of its own. Every field a condition filters on is a reference (a user field, a role's or the tenant's reference, a membership's scope and member), and each already has its own index. Keeping a reference inside the tenant finds the record it points at by id, its primary key. A move to another tenant finds the records referring to it by their reference, which has its index. So neither needs an index or a migration of its own.