Function write_subject 

pub fn write_subject<'a>(
    account: &'a str,
    kind: SubjectKind<'a>,
    handle: Option<&'a str>,
    pds_did: &'a str,
    pds_hostname: &'a str,
    operator_did: Option<&'a str>,
    client_id: Option<&'a ClientId>,
    collection: &'a str,
    action: WriteAction,
    changes: &'a [Change<'a>],
    before: Option<&'a Value>,
    after: Option<&'a Value>,
    lookups: &'a [Lookup<'a>],
    now: OffsetDateTime,
) -> Subject<'a>

Builds the Subject::Write a gate judges one write against.

client_id is the application whose OAuth token presented the write, or None when the account wrote with its own credential. now is the instant the whole request is judged at — see Universal::now on why an evaluator never reads its own clock.

changes and the two records are two views of one write, and both are passed rather than either derived: the diff is what the applicability index walks, and the records are what an evaluator reading fields reads.

lookups are what the policies applicable to this write declared they read, already read — see didbot_policy::Lookup. They arrive as an argument for the same reason now does: an evaluator judging this subject can reach nothing its arguments do not already hold.