Anyone signed in, or anyone

Use these for records that everyone signed in, or the whole world, may see, such as published articles. Access.authenticated lets in anyone who is signed in. Access.public lets in anyone at all, signed in or not.

entity Article {    ...    policy: {        read: [Access.public]        create: [CompanyRole.editor]        update: [CompanyRole.editor]        delete: [CompanyRole.owner]    }}

Anyone may read an article. Only the company's editors may create or change one, and only its owners may delete one.

A public read also needs a route that skips sign-in, one that says authentication: RouteAuthentication.none (Routes: signed in by default). Either alone isn't enough: the route lets in callers who aren't signed in, and the grant lets them read the record.

There is no administrator who bypasses policy.