Expand description
Which records a write’s policies read, gathered from the whole set.
A policy declares its lookups in its own record; the write path has to know them before it judges anything, because reading somebody else’s repository is I/O and the gate is judged inside a synchronous section. So this module answers one question — for a write to this collection, which records does any applicable policy want? — and the write path reads exactly those, once, before the write is judged.
The answer is the union over every policy that could be asked about the write, not over the ones that will actually deny it. A policy’s statements are opaque here, so there is no cheaper filter than its declared applicability, and reading a record for a policy that then has nothing to say costs one cached fetch rather than a wrong verdict.
Structs§
- Lookups
- Every lookup the policies a deployment has loaded declare, with the applicability of the policy that declared each.