The aggregate an access policy is checked on, and the callers it is checked for (accessPolicySpec).
The aggregate after events, one commit each, in scope.
The aggregate in state and scope.
Checks what caller may do with the aggregate.
Checks what a caller subject may do, holding claims, with roles (its roles claim).
roles