Policy

A rule: which principals may do which actions on which model, narrowed by a filter in the query grammar. Packs ship defaults, admins edit them, Shares compile into them.


Pack	System
Version	v1 (latest)
URN	`urn:postware:system:policy`
Identity	`name`

Fields

Field	Type	Req	Notes
`name`	string	yes
`principal`	object	yes	the class of caller the policy applies to; `{kind: enum(role\|end_user\|share\|public), value?: string}`
`applies_to`	string	yes	a model name, or * for every model
`actions`	enum(read\|create\|update\|delete)[]	yes
`where`	object	no	a where object of the query grammar; variables @principal.person, @principal.member, @principal.identity, @principal.affiliated_organizations, @share.id, @now; ``
`fields`	string[]	no	field allow-list for read or update
`enabled`	bool	yes	default `true`
`origin`	enum(pack\|workspace\|share)	yes	who created it; default `workspace`