QueryPolicy
A mandatory restriction of an aggregate's queries, evaluated at admission step 2 (QueryAdmission): the engine's own rules, the caller's tenant and the default rule (ScopeQueryPolicy), the access policies (AccessQueryPolicy), the store's cost guard on the events (me.ahoo.wow.query.events.UnpinnedEvents). It is Wow's, not an application's: which rows a caller reads is its aggregate's access policy's (me.ahoo.wow.api.access.AccessPolicy), whether it reads a model at all a ReadAuthorizer's.
Each policy reads the same query, the one every QueryFilter rewrite produced with the caller's scope and route selection appended, and the caller (the identity is an explicit argument, not a Reactor context), and returns one filter or throws. MatchAllFilter adds no restriction. Admission appends the policy filters (ANDed) after every rewrite, so no filter can remove them; the model's default scope, validation and execution follow. Gateways and admitted point reads run the same stage. A policy uses the query context to decide whether it applies, returning MatchAllFilter when it does not. Policies do not replace queries, execute backends, or transform results. On the events model, each policy's filter is the whole rule: it reads only what each stream records (its tenant, its aggregate's current access attributes).
Policies run one after another by order, lowest first (policies of one order keep their registration order). Their filters are ANDed, so the order decides only which policy's error, and which audit entry, comes first.