Who sees what, and how it is enforced
Four rules per table, five possible audiences, and a check on the server on every request.
Every table has four rules — read, create, update and delete — and every rule has one of five audiences:
- Everyone — including people who are not signed in. Right for a catalogue, a menu, a price list.
- Signed-in users — anyone with an account on your site.
- Only the creator — each person sees their own rows and nobody else's. This is the right rule for orders, tickets and bookings.
- Admins — only the people you have marked as an admin on your site.
- Nobody — the action is closed off from the site entirely. Right for a table only you fill in, from the data screen.
Why this is more than a statement
The rules are checked on the server on every request, and when the rule is “only the creator” the filter goes inside the query itself. A mistake returns zero rows — never somebody else's rows.
The record tables are closed to the public key completely, so there is no way to read from them in the browser even if somebody goes around your site's code.
Changing them
On the “Data” screen, in the “Permissions” tab, there is a grid of the four actions against the audiences. A change takes effect immediately and is written to the log.
A rule nobody set is read strictly: public read, create for signed-in users, and update and delete for the creator only.