Rule debugging

The administrator simulator reports the stored expression, allow/deny result and redacted input summary.

Actor IDs are partially redacted and record values are represented by field names, not values. The simulator is an explanation tool: it never replaces the exact server-side check performed for a real request.

Test every operation independently, including list and individual view. A permissive view rule does not imply update or delete authority.