Rule recipes

Start closed, open one operation at a time, and test each recipe against real actors and representative record values.

Authenticated read-only

{"list":"actor.id != ''","view":"actor.id != ''",
 "create":"false","update":"false","delete":"false"}

Owner-managed records

{"list":"actor.id != ''","view":"owner_id = actor.id",
 "create":"actor.id != ''","update":"owner_id = actor.id",
 "delete":"owner_id = actor.id"}

Public catalogue, private administration

{"list":"true","view":"true","create":"false",
 "update":"false","delete":"false"}

Service-only ingestion

{"list":"actor.kind = 'service'","view":"actor.kind = 'service'",
 "create":"actor.kind = 'service'","update":"false","delete":"false"}

Service rules still require matching credential scopes. Run every operation through the Settings simulator, then verify with an actual bearer request before relying on the policy.