Problem
Access membership conditions can match one target value and restrict assignment Records by actor.user only. They cannot correlate another assignment field with a field on the protected Record. This prevents typed assignment Entities from expressing multi-dimensional scopes without adding redundant Entities or bespoke permission code.
Required behavior
- Allow membership where values to reference actor context or validated record field paths.
- Type-check both sides through Entity and relationship metadata.
- Compile correlated conditions into the same SQL EXISTS scope as the current membership rule.
- Evaluate the same condition for proposed Records during create and update.
- Show each correlation in permission explanations.
- Keep the language restricted. Do not allow raw SQL or App code callbacks.
Acceptance criteria
- A policy can match an assignment to the actor and correlate one or more assignment fields with protected Record fields.
- List, Get, Count, mutations, actions, and Link searches use the same compiled scope.
- Invalid or incompatible paths fail access metadata validation.
- Permission explanations identify the assignment Entity and each correlation.
Problem
Access membership conditions can match one target value and restrict assignment Records by actor.user only. They cannot correlate another assignment field with a field on the protected Record. This prevents typed assignment Entities from expressing multi-dimensional scopes without adding redundant Entities or bespoke permission code.
Required behavior
Acceptance criteria