The permissions report

Policy is written beside each entity, so nobody has to keep a central copy. To see the whole app at once, read the report jadpo check writes: build/report/permissions.md, with a .json twin. It says who can do what to every entity and field, and which actions are listed separately. Each list is shown as written, and an effect nobody is granted says so.

Here is part of the report for Policy, end to end:

Belongs to a Company through company_id. Only an action listed under actions: changes company_id.

A field that narrows its entity's grants gets a row of its own beside "the record". For the Project under Field restrictions:

When a change alters this table, the approval review shows it in plain terms, such as "viewers can now read budget" (Review and sign-off).

Policy adds no index of its own. Every field a condition filters on is a reference (a user field, a role's or the tenant's reference, a membership's scope and member), and each already has its own index. Keeping a reference inside the tenant finds the record it points at by id, its primary key. A move to another tenant finds the records referring to it by their reference, which has its index. So neither needs an index or a migration of its own.