# Anyone signed in, or anyone

Use these for records that everyone signed in, or the whole world, may
see, such as published articles. `Access.authenticated` lets in anyone who
is signed in. `Access.public` lets in anyone at all, signed in or not.

```jadpo
entity Article {
    ...
    policy: {
        read: [Access.public]
        create: [CompanyRole.editor]
        update: [CompanyRole.editor]
        delete: [CompanyRole.owner]
    }
}
```

Anyone may read an article. Only the company's editors may create or
change one, and only its owners may delete one.

A public read also needs a route that skips sign-in, one that says
`authentication: RouteAuthentication.none`
([Routes: signed in by default](routes-signed-in-by-default.md)).
Either alone isn't enough: the route lets in callers who aren't signed in,
and the grant lets them read the record.

There is no administrator who bypasses policy.