Quickstart

​

1. A table to protect

​

2. Choose the rule

1. Open the table → Access tab.
2. Under Quick access set, choose Each user sees and changes their own records.
3. Read the result: all five actions use Record owner, except Add records, which allows Signed-in users.
4. Studio shows no warnings (a warning would appear if a write were public). Save.

​

3. Write a custom rule

​

4. Prove it

const ada = await signedIn("ada@example.com", "…");
const bob = await signedIn("bob@example.com", "…");

const note = await ada.from("notes").create({ text: "secret" });

const list = await bob.from("notes");                          // { data: [] }: Bob sees none of Ada's
await bob.from("notes").get(note.id);                          // throws NotFoundError
await bob.from("notes").update(note.id, { text: "hacked" });   // throws NotFoundError

​

5. See the decision in Studio

​

What you learned

• A rule is attached per action (list, get, create, update, delete).
• Built-in names cover the common cases; custom conditions cover the rest.
• A list of rules means all must pass.
• You prove rules by acting as different people.