Peek and Read
Peek controls whether a resource appears; Read controls access to its full data.
Permissions guide
Test who can perform each operation.
Open the table gate for the intended audience, keep individual rows as narrow as the product requires, and test access through ordinary accounts.
- Table
- Record
- Relationship + action
Permission vocabulary
Give each operation its own decision.
Create and Update
Allow record creation independently from changing existing records.
Delete
Keep destructive access separate even when users may update the same record.
Execute and Refer
Execute gates actions. Refer decides whether a record can be used in a relationship.
Two layers
Opening a table does not make every row public.
AccessGroups determines which groups may reach a
table or schema-managed action. Table and default permissions
establish the broad policy; each record's permission and owner
determine access to that row.
Guest
Use only for operations or records intentionally available without a signed-in identity.
Owner
Use the record's user_account_id when people
should control their own records.
Group
Share records with team members through group membership rather than copying rows per user.
Administrator
Test ordinary users separately; administrator success does not prove the application access rules.
Common product patterns
Start from the narrowest useful rule.
Public catalogue
Guests may peek and read published records while authenticated operators create and change them.
Private account data
Authenticated users reach the table, while owner permissions keep each row private to its creator.
Shared workspace
Group permissions expose workspace records to members; relationship checks prevent linking inaccessible objects.
Privileged operation
Let users read a record without automatically granting permission to execute every action attached to it.
Verification matrix
Exercise every role and operation.
- Test list visibility and full read separately.
- Test create, update, and delete as guest, user, owner, group member, unrelated user, and administrator.
- Attempt to link both accessible and inaccessible records.
- Execute each action with allowed and denied callers.
- Change group membership and reconnect long-lived clients before rechecking access.
-
Remember that changing
DefaultPermissionaffects newly created rows; migrate existing rows. - Inspect access after schema synchronization and after runtime permission-cache invalidation.