Query related records and explain an access decision

Run a relationship read

Open Administration → Access policies & relationship queries as a platform administrator. Select a registered table and use the schema view to find forward and reverse relationships. Start with a bounded result and explicit fields. For example, send this body to POST /api/admin/record-security/query:

{
  "table": "users",
  "fields": ["firstName", "managerId.email"],
  "filter": {"field": "active", "operator": "equals", "value": true},
  "limit": 10,
  "offset": 0
}

Forward paths return a scalar or null. Reverse paths return ordered collections. For example, from companies, a supported reverse path can use ^departments:company_id.^users:department_id.email where the registry makes those edges unambiguous. Related filters use existence checks, so separate conditions may match different related rows. Check truncation flags on long text and large collections. For a cursor page, keep the table, selected fields, filter and page size identical, and omit a nonzero offset.

Simulate policy

Use the simulator with an existing table, record, active user and operation. Read the record decision and denied field names along with each rule's subject and condition match. The simulation evaluates the current memberships and active rules. If a rule is a draft, activate it only through the authorized workflow, then repeat the allowed and denied scenarios. See Record and field access.