Caches and personal data

A cache never lets a caller around policy. A record cache applies policy on every read. A query-result cache is keyed by the tenant and every input policy used. Policy itself always reads the database.

Personal data takes its permissions from policy: erasing a person's data needs delete on their record, and exporting it needs read.