ScopeAccess

The default rule: who reads and changes an aggregate that no access policy of its own governs (AccessPolicy). A caller acting in a scope reads and changes the aggregates whose owner is the scope's owner and whose space is its space, each part compared only when the scope names it: a caller with neither, of its tenant or acting across scopes without naming one, reads and changes every aggregate of its tenant. The aggregate's ownership narrows the scope first (me.ahoo.wow.api.aggregate.Ownership.scopeOf): no owner is compared for an aggregate of its tenant.

It is one rule on every path, over the built-in attributes AccessAttribute.OWNER and AccessAttribute.SPACE: the kernel evaluates it on the aggregate a command changes (allows), a state read on the state it reads, and the query side compiles it to a filter of the records it reads.