Authorization

Rule language

Rules are deliberately small boolean expressions over the authenticated actor and current record values.

Available inputs

Input	Meaning
`actor.id`	Resolved application user or service identity
`actor.kind`	`user` or `service`
Field name	Current record value, such as `owner_id`
`true`/`false`	Unconditional allow or deny

Examples

actor.id != ''
owner_id = actor.id
actor.kind = 'service'
false

Expressions parse before storage and never become raw SQL. Unknown identifiers, malformed operators and excessive complexity are rejected. Keep rules readable; when policy needs substantial domain logic, place that workflow behind a trusted backend and grant it a narrow service identity.