A user field on the record

Use a user field when a record belongs to one person, such as a todo and its owner. A user field is a reference to the user entity, the entity your app's principal names for the people who sign in. Naming it in a list, such as read: [owner_id], lets in the user it points to. A reference to the principal's service entity lets in that service in the same way.

On the user entity itself, id names the caller's own record: read: [id] lets each person read only their own.

On a create

A create is checked against the new record. So create: [owner_id] means a caller can create a todo only if they are its owner. A request that names someone else as the owner is refused.

The field can't be changed by an update

A user field that any list names can't be changed by an ordinary update, since changing it would hand the record to someone else. You don't mark it immutable: for that. To hand a record to someone else, write a named action and list it in root policy.jadpo, as Actions shows.