Protecting policy

An agent can edit policy, but the change can't ship without a person's approval, wherever it is written. The compiler compares the whole application before and after, because access also widens when an output gains a field, a route becomes public or an action starts touching another entity.

Each widening needs an acceptance: a file in acceptances/ in which a person accepts that change (Acceptances). Breaking API changes and database drops are accepted the same way.

Schedules and subscribers act as the system (Background work), and what Access.system is granted shows in the permissions report. The compiler's own purge of soft-deleted records (The purge schedule) is the only operation outside policy.

Acceptances for a change that widens access aren't built yet (What is built).