Package-level declarations
Types
An access predicate (AccessPredicate) as a filter of the query algebra, which every backend pushes down: the predicate read in negation normal form, each comparison on the field its attribute is stored under in the model queried, as fieldOf says.
The access policies of a node's aggregates (AccessPolicy, a bean of the service for each aggregate), each resolved to its aggregate and checked against the Manifest once, when the engine is built (of). An aggregate with a policy of its own is governed: its reads are what the policy's read lets a caller read (AccessQueryPolicy). Any other reads by the default rule, its caller's owner and space (ScopeQueryPolicy), as before access policies.
The read predicate of each governed aggregate as a QueryPolicy: what a caller may read of it, compiled to a filter (AccessFilters) and appended at admission step 2, right after the scope. An aggregate it does not govern is left to the default rule (ScopeQueryPolicy).
Which of a service's aggregates are read by an access policy of their own (AccessPolicies.governs), as the node that has the policies decides. A service publishes it beside the data it writes elsewhere, so that a reader that cannot evaluate the policy, such as the analytics catalog's nodes, refuses those aggregates' rows rather than reading them by the default rule: the Spring Boot host gives the ClickHouse Sink one, which its wow_catalog rows record.
What a gateway requires of a query's QueryEntry before admitting it, and the budget each entry runs under.
Who each aggregate type belongs to besides its tenant, as the Manifest's AggregateManifest.ownership says: ScopeQueryPolicy restricts a caller's queries by its owner only for an Ownership.OWNER aggregate.
A mandatory restriction of an aggregate's queries, evaluated at admission step 2 (QueryAdmission): the engine's own rules, the caller's tenant and the default rule (ScopeQueryPolicy), the access policies (AccessQueryPolicy), the store's cost guard on the events (me.ahoo.wow.query.events.UnpinnedEvents). It is Wow's, not an application's: which rows a caller reads is its aggregate's access policy's (me.ahoo.wow.api.access.AccessPolicy), whether it reads a model at all a ReadAuthorizer's.
What a caller reads: the model of type (an aggregate type, or a dataset's context and name), by operation, from entry. A state read and a trace read the snapshot model, by QueryType.STATE and QueryType.TRACE: the names wow.callers.<service>.reads gives them are <type>.state.
A read authorizer's answer: Allowed, or Denied with its Denied.message and Denied.code.
Decides whether a caller may read a model at all, before anything of it is read: a query of any model and any operation (a server-sent stream is its query's), a state read and a trace. Which rows the caller sees is the aggregate's access policy's (me.ahoo.wow.api.access.AccessPolicy), which fields the masks'; this is the role, the application, the entry: whether the caller may read here at all.
The caller's scope as a QueryPolicy, appended at admission step 2 to every query: