ReaderRole

Who reads the entries where the roles decide: a caller with one of OpsRoles.READERS reads every entry of its tenant, and any other caller's read of them, a query of any model, a state read or a trace, is refused as wow.auth.forbidden, before anything is read; trusted in-process code, which reads with no caller, is not asked. Every aggregate this service serves is an entry.

An entry is a resource of its tenant (Ownership.TENANT): no caller's owner restricts its reads, so the default rule lets every signed-in caller of the tenant read them all, an owner-level one (a principal with no ops role) as a tenant-level one. The roles are what keeps them to the operators and viewers: who reads, not which rows.