Grants

A grant says who may do one thing to an entity's records. An entity's policy: holds up to four lists of them, one for each thing: create, read, update and delete. Anyone a list names is enough to let a caller in, and anything not listed is refused. So "who can delete a project?" is one line in the project's file. In the Todo at the top of Policy, delete: [owner_id] lets the todo's owner delete it, and nobody else.

Policy is always on. From the first line of code, every create, read, update or delete your code can reach needs a grant.

Which grant an action needs

You never write which grant an action needs. The compiler sees what each query and action reads and writes. Every action that updates a Todo needs update on it, so ten actions that edit todos share one line of policy. An action that reaches several entities needs a grant on each. When an action calls another domain's action, the called action is checked against its own entities, with the same caller.

Transitions and deletes

A lifecycle transition, a named change of a record's state such as archiving it (Lifecycle), is an update. The one exception is deleting: Todo.delete(todo) needs delete, whether it removes the record or runs the lifecycle's delete transition (The operations every entity gets). So a soft delete, which keeps the record but hides it, still needs delete.