AccessScope
What an access policy's predicates are written with, for the aggregates whose state is S: comparisons of their access attributes (<State>Access, typed by S) with the caller's claims, and logic. A comparison with a claim the caller does not hold, a null or no values, denies (AccessPredicate.Unknown), as does one of a value the aggregate does not have.
Functions
Each of predicates holds; always when none is given.
Every aggregate: public data, said explicitly.
Every aggregate when condition holds, none otherwise: a condition on the caller alone, such as a role.
One of predicates holds; never when none is given.
The attribute's values hold value.
The attribute's values hold one of values.
No aggregate: write { denyAll() } for one no caller changes.
The attribute's value is value.
The attribute holds no value.
The attribute's value is one of values.
The aggregate has no value of the attribute.
predicate does not hold, of a value the aggregate has: an absent value grants neither way.
The default rule of caller (ScopeAccess): the aggregates whose owner is the owner of the scope the caller acts in and whose space is its space, each part compared only when the scope names it, and no owner for an aggregate of its tenant (ownership). A policy replaces the default rule for its aggregate, so one that keeps the aggregates to their owner and space combines its own attributes with this: allOf(DocumentStateAccess.APP eq caller.app, ownerAndSpace(caller)).
The attribute's value, a string, starts with prefix: a level of a materialized path, say.