What one caller may do with the aggregate of an AccessPolicySpec.
The caller may not read the aggregate.
The caller may not change the aggregate.
The caller may read the aggregate.
The caller may change the aggregate.