# Grants

A grant says who may do one thing to an entity's records. An entity's
`policy:` holds up to four lists of them, one for each thing: `create`,
`read`, `update` and `delete`. Anyone a list names is enough to let a
caller in, and anything not listed is refused. So "who can delete a
project?" is one line in the project's file. In the `Todo` at the top of
[Policy](policy.md), `delete: [owner_id]` lets the todo's owner delete it,
and nobody else.

Policy is always on. From the first line of code, every create, read,
update or delete your code can reach needs a grant.

## Which grant an action needs

You never write which grant an action needs. The compiler sees what each
query and action reads and writes. Every action that updates a `Todo`
needs `update` on it, so ten actions that edit todos share one line of
policy. An action that reaches several entities needs a grant on each.
When an action calls another domain's action, the called action is
checked against its own entities, with the same caller.

## Transitions and deletes

A lifecycle transition, a named change of a record's state such as
archiving it ([Lifecycle](lifecycle.md)), is an update. The one
exception is deleting: `Todo.delete(todo)` needs `delete`, whether it
removes the record or runs the lifecycle's `delete` transition
([The operations every entity gets](the-operations-every-entity-gets.md)).
So a soft delete, which keeps the record but hides it, still needs
`delete`.