AccessPredicate
What an access policy decides for one caller (AccessPolicy): a predicate over an aggregate's access attributes, the caller's claims already in it. The query side compiles it to a filter its storage applies; the kernel and the test DSL evaluate it on an aggregate's attribute values (allows). Both read it alike:
Deny by default. A comparison with a claim the caller does not hold (Unknown) holds neither way, and nor does a comparison of a value the aggregate does not have: its attribute absent, or its record holding none. The predicate is read in negation normal form,
notpushed down to the comparisons, each negated comparison holding only for a present value (not(a eq x)isapresent and notx). So an absent value or a missing claim never grants, however the predicate negates it, and SQL, document and in-memory storage agree on it.Logic. AllOf holds when each of its predicates does (none: always), AnyOf when one does (none: never), Not when its predicate does not, as above; Allowed always, Denied never.
Inheritors
Types
Holds when each of predicates does; always when there is none.
Grants: holds for every aggregate (allowAll(), allowIf(true)).
Holds when one of predicates does; never when there is none.
Denies: holds for none (denyAll(), allowIf(false)).
Holds when predicate does not, for a present value (see AccessPredicate).
A comparison with a claim the caller does not hold: it holds for none, and neither does its negation.
Functions
Whether this predicate grants access to an aggregate whose attribute values valueOf gives: a single attribute's value or null, a multiple one's values (a collection), or null when the aggregate has none of it. An enum attribute's value is its constant, as the predicate holds it.