accessPolicySpec

Checks the access policy of model's aggregates: given an aggregate (its events, or its state), whether a caller may read it and change it, as the kernel and the queries decide (the access attributes the state derives, the built-in owner and space its scope's).

accessPolicySpec(documentModel, documentAccess) {
    given(DocumentCreated("sales"), DocumentShared("bob"))
    whenCaller(subject = "bob", claims = mapOf("departments" to listOf("hr"))) {
        expectRead()
        expectNoWrite()
    }
}

A check fails, too, when the policy compares an attribute model does not declare, which a node does not refuse at its start. A policy's references are typed by its state (AccessAttribute<in S, V>, generated in <State>Access), so such a comparison hardly compiles; one that does, as in a policy built against another version of the state, matches no aggregate when a node evaluates it (it fails closed), and the node logs it once.