@feltdb/core 0.4.15 → 0.4.16

package/dist/create/server-source/crates/feltdb/src/policy_evaluation.rs

@@ -0,0 +1,1669 @@
+//! Runtime policy enforcement for FlowSpec policies.
+//!
+//! This module implements the runtime semantics for FlowSpec policy declarations,
+//! allowing applications to declare authorization rules at the schema level and have
+//! them enforced at the runtime boundary.
+//!
+//! FlowSpec policies declare authorization rules like:
+//!
+//! ```text
+//! policy Project {
+//!   read: authenticated
+//!   write: owner
+//! }
+//! ```
+//!
+//! This module provides:
+//! - Policy subject types (authenticated, owner, etc.)
+//! - Authorization context with actor information
+//! - Policy evaluation engine
+//! - Stable authorization errors
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::collections::BTreeMap;
+use std::sync::Arc;
+
+/// An actor attempting to access a resource.
+///
+/// Represents the identity performing a request. The `id` is typically a user ID,
+/// agent ID, or other stable identifier.
+///
+/// `None` represents an unauthenticated/anonymous actor.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Actor {
+    pub id: String,
+}
+
+impl Actor {
+    pub fn new(id: impl Into<String>) -> Self {
+        Self { id: id.into() }
+    }
+}
+
+/// Authorization context for policy evaluation.
+///
+/// Contains the actor performing the operation and additional context needed
+/// to evaluate policies.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PolicyContext {
+    /// The actor attempting the operation, or None if unauthenticated
+    pub actor: Option<Actor>,
+
+    /// The resource being accessed (collection name and record ID)
+    pub resource_collection: String,
+    pub resource_id: String,
+
+    /// Additional attributes that can be used in policy evaluation
+    /// For example: owner_id for owner policy checks
+    pub resource_attributes: BTreeMap<String, String>,
+}
+
+impl PolicyContext {
+    pub fn new(
+        actor: Option<Actor>,
+        collection: impl Into<String>,
+        resource_id: impl Into<String>,
+    ) -> Self {
+        Self {
+            actor,
+            resource_collection: collection.into(),
+            resource_id: resource_id.into(),
+            resource_attributes: BTreeMap::new(),
+        }
+    }
+
+    pub fn with_attributes(mut self, attrs: BTreeMap<String, String>) -> Self {
+        self.resource_attributes = attrs;
+        self
+    }
+
+    pub fn set_attribute(&mut self, key: impl Into<String>, value: impl Into<String>) {
+        self.resource_attributes.insert(key.into(), value.into());
+    }
+}
+
+/// Policy subject - the authorization rule that determines access.
+///
+/// Subjects represent different types of authorization checks that can be performed.
+/// `authenticated`, `owner`, `member`, and `self` are supported.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PolicySubject {
+    /// Allows access when actor is authenticated (not None).
+    Authenticated,
+
+    /// Allows access when actor owns the resource.
+    /// The resource's owner is determined by the owner_id field in the record.
+    Owner,
+
+    /// Allows access when actor is a member of the organization that owns the resource.
+    /// The resource's organization is determined by the organization reference field.
+    /// Membership is verified by checking: membership.user_id == actor.id AND membership.organization_id == resource.organization_id
+    Member,
+
+    /// Allows access when the specified field value identifies the actor by stable ID.
+    /// The field value must equal actor.id. Typically used with reference fields.
+    /// If the field is missing or null, access is denied.
+    Self_ { field: String },
+}
+
+impl PolicySubject {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            PolicySubject::Authenticated => "authenticated",
+            PolicySubject::Owner => "owner",
+            PolicySubject::Member => "member",
+            PolicySubject::Self_ { .. } => "self",
+        }
+    }
+
+    /// Parse a policy subject from a string.
+    /// For self policies, the field name must be included in format: "self(field_name)"
+    /// Returns None if the subject is not recognized.
+    pub fn from_str(s: &str) -> Option<Self> {
+        if let Some(field) = s.strip_prefix("self(").and_then(|s| s.strip_suffix(")")) {
+            return Some(PolicySubject::Self_ { field: field.to_string() });
+        }
+        match s {
+            "authenticated" => Some(PolicySubject::Authenticated),
+            "owner" => Some(PolicySubject::Owner),
+            "member" => Some(PolicySubject::Member),
+            _ => None,
+        }
+    }
+}
+
+/// Authorization decision - the result of policy evaluation.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AuthorizationDecision {
+    /// Access is allowed
+    Allow,
+    /// Access is denied
+    Deny,
+}
+
+/// Error type for authorization failures.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PolicyAuthorizationError {
+    pub code: String,
+    pub message: String,
+}
+
+impl PolicyAuthorizationError {
+    pub fn new(code: &str, message: impl Into<String>) -> Self {
+        Self {
+            code: code.into(),
+            message: message.into(),
+        }
+    }
+
+    pub fn unauthenticated(reason: impl Into<String>) -> Self {
+        Self::new("UNAUTHENTICATED", reason)
+    }
+
+    pub fn unauthorized(reason: impl Into<String>) -> Self {
+        Self::new("UNAUTHORIZED", reason)
+    }
+}
+
+impl std::fmt::Display for PolicyAuthorizationError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}: {}", self.code, self.message)
+    }
+}
+
+impl std::error::Error for PolicyAuthorizationError {}
+
+/// Immutable authorization state for policy evaluation.
+///
+/// Provides read-only access to the schema metadata and the immutable snapshot
+/// required for record-level policy evaluation. Policies can access authoritative
+/// database state without ability to mutate it.
+///
+/// The snapshot must correspond to the same snapshot boundary used to evaluate
+/// the protected record, ensuring snapshot consistency during authorization.
+#[derive(Debug, Clone)]
+pub struct AuthorizationState {
+    /// Schema metadata including field definitions and references.
+    /// Used for discovering relationships between collections (e.g., Project → Organization).
+    pub schema: Arc<crate::state_contract::StateSchema>,
+
+    /// State namespace (e.g., "tenant:123") used to construct capability keys
+    /// when querying the snapshot.
+    pub state_namespace: String,
+
+    /// Immutable snapshot of persisted records at the authorization boundary.
+    /// Contains StoredRow entries with keys in format "capability:record_id".
+    /// Used by policies to verify relationships (e.g., membership, ownership).
+    ///
+    /// This is the same snapshot used to load the protected record being authorized,
+    /// guaranteeing snapshot consistency for policy decisions.
+    pub snapshot_rows: Arc<Vec<crate::StoredRow>>,
+}
+
+impl AuthorizationState {
+    /// Create a new authorization state.
+    pub fn new(
+        schema: Arc<crate::state_contract::StateSchema>,
+        state_namespace: impl Into<String>,
+        snapshot_rows: Arc<Vec<crate::StoredRow>>,
+    ) -> Self {
+        Self {
+            schema,
+            state_namespace: state_namespace.into(),
+            snapshot_rows,
+        }
+    }
+
+    /// Lookup a record in the snapshot by collection and key.
+    /// Returns None if the record doesn't exist or is marked deleted.
+    pub fn lookup_record(&self, collection: &str, key: &str) -> Option<Value> {
+        let capability = format!("{}:{}", self.state_namespace, collection);
+        self.snapshot_rows
+            .iter()
+            .find(|row| {
+                row.capability == capability && row.key == key && !row.deleted
+            })
+            .map(|row| row.value.clone())
+    }
+
+    /// Iterate over all records in a collection within the snapshot.
+    pub fn records_in_collection(&self, collection: &str) -> Vec<Value> {
+        let capability = format!("{}:{}", self.state_namespace, collection);
+        self.snapshot_rows
+            .iter()
+            .filter(|row| row.capability == capability && !row.deleted)
+            .map(|row| row.value.clone())
+            .collect()
+    }
+
+    /// Find a field in a collection that references another collection.
+    /// Returns the field name if found.
+    pub fn find_reference_field(&self, from_collection: &str, to_collection: &str) -> Option<String> {
+        let collection = self.schema.collections
+            .iter()
+            .find(|c| c.name == from_collection)?;
+
+        collection.fields
+            .iter()
+            .find_map(|field| {
+                if let crate::state_contract::FieldType::Reference { collection: ref_col } = &field.field_type {
+                    if ref_col == to_collection {
+                        return Some(field.name.clone());
+                    }
+                }
+                None
+            })
+    }
+
+    /// Find which collection contains membership information (references both User and Organization).
+    /// Returns the collection name if found.
+    pub fn find_membership_collection(&self) -> Option<String> {
+        // Look for a collection that has references to both User and Organization
+        for collection in &self.schema.collections {
+            let has_user_ref = collection.fields.iter().any(|f| {
+                if let crate::state_contract::FieldType::Reference { collection: ref_col } = &f.field_type {
+                    ref_col == "User" || ref_col == "Users"
+                } else {
+                    false
+                }
+            });
+
+            let has_org_ref = collection.fields.iter().any(|f| {
+                if let crate::state_contract::FieldType::Reference { collection: ref_col } = &f.field_type {
+                    ref_col == "Organization" || ref_col == "Organizations"
+                } else {
+                    false
+                }
+            });
+
+            if has_user_ref && has_org_ref {
+                return Some(collection.name.clone());
+            }
+        }
+        None
+    }
+
+    /// Find field names for user and organization references within a collection.
+    /// Returns (user_field, org_field) if both are found.
+    pub fn find_membership_fields(&self, collection_name: &str) -> Option<(String, String)> {
+        let collection = self.schema.collections
+            .iter()
+            .find(|c| c.name == collection_name)?;
+
+        let mut user_field = None;
+        let mut org_field = None;
+
+        for field in &collection.fields {
+            if let crate::state_contract::FieldType::Reference { collection: ref_col } = &field.field_type {
+                if (ref_col == "User" || ref_col == "Users") && user_field.is_none() {
+                    user_field = Some(field.name.clone());
+                }
+                if (ref_col == "Organization" || ref_col == "Organizations") && org_field.is_none() {
+                    org_field = Some(field.name.clone());
+                }
+            }
+        }
+
+        match (user_field, org_field) {
+            (Some(u), Some(o)) => Some((u, o)),
+            _ => None,
+        }
+    }
+}
+
+/// Record authorization context for record-level policy evaluation.
+///
+/// Contains an actual persisted or proposed record and metadata needed to evaluate
+/// policies that depend on individual record state (e.g., member, owner).
+///
+/// All record data is derived from FeltDB state, never from caller attributes.
+#[derive(Debug, Clone)]
+pub struct RecordAuthorizationContext {
+    /// The actor attempting the operation, or None if unauthenticated
+    pub actor: Option<Actor>,
+    /// The collection containing the record
+    pub collection: String,
+    /// The record ID
+    pub record_id: String,
+    /// The actual record data as persisted/proposed in FeltDB
+    /// This is authoritative for derived values (organization, ownership, etc.)
+    pub record_value: serde_json::Value,
+    /// Optional authorization state for policies that need to verify relationships.
+    /// Provides read-only access to schema metadata and the immutable snapshot.
+    /// None for policies that only check caller authentication or direct field values (authenticated, owner).
+    pub authorization_state: Option<AuthorizationState>,
+}
+
+impl RecordAuthorizationContext {
+    /// Create a new record authorization context.
+    ///
+    /// Parameters:
+    /// - actor: The authenticated actor attempting the operation
+    /// - collection: The collection name
+    /// - record_id: The record's ID
+    /// - record_value: The actual record value from FeltDB
+    pub fn new(
+        actor: Option<Actor>,
+        collection: impl Into<String>,
+        record_id: impl Into<String>,
+        record_value: serde_json::Value,
+    ) -> Self {
+        Self {
+            actor,
+            collection: collection.into(),
+            record_id: record_id.into(),
+            record_value,
+            authorization_state: None,
+        }
+    }
+
+    /// Builder method to attach authorization state.
+    pub fn with_state(mut self, state: AuthorizationState) -> Self {
+        self.authorization_state = Some(state);
+        self
+    }
+
+    /// Extract a field value from the record.
+    pub fn field(&self, name: &str) -> Option<&serde_json::Value> {
+        self.record_value.get(name)
+    }
+}
+
+/// Policy evaluator - determines if a subject allows access.
+pub struct PolicyEvaluator;
+
+impl PolicyEvaluator {
+    /// Evaluate a single policy subject against a context.
+    ///
+    /// Returns `Allow` if the policy subject permits access, `Deny` otherwise.
+    /// Note: Self policies are only supported at record level (evaluate_record).
+    pub fn evaluate(
+        subject: PolicySubject,
+        context: &PolicyContext,
+    ) -> Result<AuthorizationDecision, PolicyAuthorizationError> {
+        match subject {
+            PolicySubject::Authenticated => Self::evaluate_authenticated(context),
+            PolicySubject::Owner => Self::evaluate_owner(context),
+            PolicySubject::Member => Self::evaluate_member(context),
+            PolicySubject::Self_ { .. } => {
+                Err(PolicyAuthorizationError::new(
+                    "INVALID_POLICY_CONTEXT",
+                    "self policies require record-level context; use evaluate_record instead",
+                ))
+            }
+        }
+    }
+
+    /// Evaluate a policy subject against a record-level authorization context.
+    ///
+    /// This is used at query and mutation execution time to make per-record
+    /// authorization decisions based on the actual persisted record state.
+    ///
+    /// Unlike evaluate(), which checks caller-supplied attributes, this method
+    /// derives all authorization facts from FeltDB state.
+    pub fn evaluate_record(
+        subject: PolicySubject,
+        context: &RecordAuthorizationContext,
+    ) -> Result<AuthorizationDecision, PolicyAuthorizationError> {
+        match subject {
+            PolicySubject::Authenticated => Self::evaluate_record_authenticated(context),
+            PolicySubject::Owner => Self::evaluate_record_owner(context),
+            PolicySubject::Member => Self::evaluate_record_member(context),
+            PolicySubject::Self_ { field } => Self::evaluate_record_self(&field, context),
+        }
+    }
+
+    /// Authenticated subject: allows access when actor is present.
+    fn evaluate_authenticated(
+        context: &PolicyContext,
+    ) -> Result<AuthorizationDecision, PolicyAuthorizationError> {
+        if context.actor.is_some() {
+            Ok(AuthorizationDecision::Allow)
+        } else {
+            Err(PolicyAuthorizationError::unauthenticated(
+                "authenticated policy requires an authenticated actor",
+            ))
+        }
+    }
+
+    /// Owner subject: allows access when actor is the resource owner.
+    fn evaluate_owner(
+        context: &PolicyContext,
+    ) -> Result<AuthorizationDecision, PolicyAuthorizationError> {
+        let actor = context.actor.as_ref().ok_or_else(|| {
+            PolicyAuthorizationError::unauthenticated(
+                "owner policy requires an authenticated actor",
+            )
+        })?;
+
+        let owner_id = context.resource_attributes.get("owner_id").ok_or_else(|| {
+            PolicyAuthorizationError::new(
+                "OWNERSHIP_NOT_DEFINED",
+                "resource does not have an owner_id attribute; ownership is not supported for this collection",
+            )
+        })?;
+
+        if actor.id == *owner_id {
+            Ok(AuthorizationDecision::Allow)
+        } else {
+            Err(PolicyAuthorizationError::unauthorized(
+                format!(
+                    "actor {} is not the owner ({})",
+                    actor.id, owner_id
+                ),
+            ))
+        }
+    }
+
+    /// Member subject: allows access when actor is a member of the resource's organization.
+    fn evaluate_member(
+        context: &PolicyContext,
+    ) -> Result<AuthorizationDecision, PolicyAuthorizationError> {
+        let actor = context.actor.as_ref().ok_or_else(|| {
+            PolicyAuthorizationError::unauthenticated(
+                "member policy requires an authenticated actor",
+            )
+        })?;
+
+        let organization_id = context.resource_attributes.get("organization_id").ok_or_else(|| {
+            PolicyAuthorizationError::new(
+                "ORGANIZATION_NOT_DEFINED",
+                "resource does not have an organization_id attribute; member policy cannot be evaluated",
+            )
+        })?;
+
+        let is_member = context.resource_attributes.get("is_member")
+            .map(|v| v == "true")
+            .unwrap_or(false);
+
+        if is_member {
+            Ok(AuthorizationDecision::Allow)
+        } else {
+            Err(PolicyAuthorizationError::unauthorized(
+                format!(
+                    "actor {} is not a member of organization {}",
+                    actor.id, organization_id
+                ),
+            ))
+        }
+    }
+
+    // Record-level authorization evaluation methods
+    // These evaluate policies based on actual persisted record state,
+    // deriving all authorization facts from FeltDB, not from caller attributes.
+
+    /// Authenticated subject at record level: allows if actor is present.
+    fn evaluate_record_authenticated(
+        context: &RecordAuthorizationContext,
+    ) -> Result<AuthorizationDecision, PolicyAuthorizationError> {
+        if context.actor.is_some() {
+            Ok(AuthorizationDecision::Allow)
+        } else {
+            Err(PolicyAuthorizationError::unauthenticated(
+                "authenticated policy requires an authenticated actor",
+            ))
+        }
+    }
+
+    /// Owner subject at record level: allows if actor owns the resource.
+    /// Ownership is determined by the owner_id field in the record.
+    fn evaluate_record_owner(
+        context: &RecordAuthorizationContext,
+    ) -> Result<AuthorizationDecision, PolicyAuthorizationError> {
+        let actor = context.actor.as_ref().ok_or_else(|| {
+            PolicyAuthorizationError::unauthenticated(
+                "owner policy requires an authenticated actor",
+            )
+        })?;
+
+        let owner_id = context.field("owner_id")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| {
+                PolicyAuthorizationError::new(
+                    "OWNERSHIP_NOT_DEFINED",
+                    "record does not have an owner_id field; ownership is not supported for this collection",
+                )
+            })?;
+
+        if actor.id == owner_id {
+            Ok(AuthorizationDecision::Allow)
+        } else {
+            Err(PolicyAuthorizationError::unauthorized(
+                format!(
+                    "actor {} is not the owner ({})",
+                    actor.id, owner_id
+                ),
+            ))
+        }
+    }
+
+    /// Member subject at record level: allows if actor is a member of the resource's organization.
+    /// Organization is determined by resolving the organization reference from the record.
+    /// Membership is verified by checking the Membership collection in the snapshot.
+    fn evaluate_record_member(
+        context: &RecordAuthorizationContext,
+    ) -> Result<AuthorizationDecision, PolicyAuthorizationError> {
+        let actor = context.actor.as_ref().ok_or_else(|| {
+            PolicyAuthorizationError::unauthenticated(
+                "member policy requires an authenticated actor",
+            )
+        })?;
+
+        let auth_state = context.authorization_state.as_ref().ok_or_else(|| {
+            PolicyAuthorizationError::new(
+                "AUTHORIZATION_STATE_NOT_AVAILABLE",
+                "member policy requires access to database state (authorization_state not provided)",
+            )
+        })?;
+
+        // Find the reference field from this collection to Organization
+        let org_ref_field = auth_state.find_reference_field(&context.collection, "Organization")
+            .or_else(|| auth_state.find_reference_field(&context.collection, "Organizations"))
+            .ok_or_else(|| {
+                PolicyAuthorizationError::new(
+                    "ORGANIZATION_NOT_DEFINED",
+                    "resource collection does not have a reference to Organization",
+                )
+            })?;
+
+        // Extract the organization ID from the record
+        let organization_id = context.field(&org_ref_field)
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| {
+                PolicyAuthorizationError::new(
+                    "ORGANIZATION_NOT_DEFINED",
+                    format!("record does not have a valid {} field", org_ref_field),
+                )
+            })?;
+
+        // Find the membership collection
+        let membership_collection = auth_state.find_membership_collection()
+            .ok_or_else(|| {
+                PolicyAuthorizationError::new(
+                    "MEMBERSHIP_NOT_DEFINED",
+                    "schema does not define a membership collection (collection with references to both User and Organization)",
+                )
+            })?;
+
+        // Find the field names for user and organization references in the membership collection
+        let (user_field, org_field) = auth_state.find_membership_fields(&membership_collection)
+            .ok_or_else(|| {
+                PolicyAuthorizationError::new(
+                    "MEMBERSHIP_NOT_DEFINED",
+                    "membership collection does not have both user and organization references",
+                )
+            })?;
+
+        // Query for matching membership record
+        let membership_records = auth_state.records_in_collection(&membership_collection);
+
+        let has_membership = membership_records.iter().any(|record| {
+            if let Some(obj) = record.as_object() {
+                let user_match = obj
+                    .get(&user_field)
+                    .and_then(|v| v.as_str())
+                    .map(|u| u == actor.id)
+                    .unwrap_or(false);
+
+                let org_match = obj
+                    .get(&org_field)
+                    .and_then(|v| v.as_str())
+                    .map(|o| o == organization_id)
+                    .unwrap_or(false);
+
+                user_match && org_match
+            } else {
+                false
+            }
+        });
+
+        if has_membership {
+            Ok(AuthorizationDecision::Allow)
+        } else {
+            Err(PolicyAuthorizationError::unauthorized(
+                format!(
+                    "actor {} is not a member of organization {}",
+                    actor.id, organization_id
+                ),
+            ))
+        }
+    }
+
+    /// Self subject at record level: allows if record field identifies the actor.
+    /// The field value must equal actor.id (stable identity matching).
+    /// If the field is missing or null, access is denied.
+    fn evaluate_record_self(
+        field: &str,
+        context: &RecordAuthorizationContext,
+    ) -> Result<AuthorizationDecision, PolicyAuthorizationError> {
+        let actor = context.actor.as_ref().ok_or_else(|| {
+            PolicyAuthorizationError::unauthenticated(
+                "self policy requires an authenticated actor",
+            )
+        })?;
+
+        let field_value = context.field(field)
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| {
+                PolicyAuthorizationError::new(
+                    "IDENTITY_NOT_FOUND",
+                    format!("record does not have a valid {} field", field),
+                )
+            })?;
+
+        if actor.id == field_value {
+            Ok(AuthorizationDecision::Allow)
+        } else {
+            Err(PolicyAuthorizationError::unauthorized(
+                format!(
+                    "actor {} does not match identity field {}",
+                    actor.id, field
+                ),
+            ))
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn authenticated_allows_with_actor() {
+        let context = PolicyContext::new(Some(Actor::new("user123")), "Todo", "todo-1");
+        let result = PolicyEvaluator::evaluate(PolicySubject::Authenticated, &context);
+        assert_eq!(result, Ok(AuthorizationDecision::Allow));
+    }
+
+    #[test]
+    fn authenticated_denies_without_actor() {
+        let context = PolicyContext::new(None, "Todo", "todo-1");
+        let result = PolicyEvaluator::evaluate(PolicySubject::Authenticated, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHENTICATED");
+    }
+
+    #[test]
+    fn owner_allows_when_actor_is_owner() {
+        let mut context = PolicyContext::new(Some(Actor::new("user123")), "Project", "project-1");
+        context.set_attribute("owner_id", "user123");
+        let result = PolicyEvaluator::evaluate(PolicySubject::Owner, &context);
+        assert_eq!(result, Ok(AuthorizationDecision::Allow));
+    }
+
+    #[test]
+    fn owner_denies_when_actor_is_not_owner() {
+        let mut context = PolicyContext::new(Some(Actor::new("user123")), "Project", "project-1");
+        context.set_attribute("owner_id", "user456");
+        let result = PolicyEvaluator::evaluate(PolicySubject::Owner, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
+    }
+
+    #[test]
+    fn owner_denies_without_actor() {
+        let context = PolicyContext::new(None, "Project", "project-1");
+        let result = PolicyEvaluator::evaluate(PolicySubject::Owner, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHENTICATED");
+    }
+
+    #[test]
+    fn owner_denies_without_owner_id_attribute() {
+        let context = PolicyContext::new(Some(Actor::new("user123")), "Project", "project-1");
+        let result = PolicyEvaluator::evaluate(PolicySubject::Owner, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "OWNERSHIP_NOT_DEFINED");
+    }
+
+    #[test]
+    fn policy_subject_from_str() {
+        assert_eq!(PolicySubject::from_str("authenticated"), Some(PolicySubject::Authenticated));
+        assert_eq!(PolicySubject::from_str("owner"), Some(PolicySubject::Owner));
+        assert_eq!(PolicySubject::from_str("member"), Some(PolicySubject::Member));
+        assert_eq!(PolicySubject::from_str("invalid"), None);
+    }
+
+    #[test]
+    fn member_allows_when_actor_is_member() {
+        let mut context = PolicyContext::new(Some(Actor::new("user123")), "Project", "project-1");
+        context.set_attribute("organization_id", "org-abc");
+        context.set_attribute("is_member", "true");
+        let result = PolicyEvaluator::evaluate(PolicySubject::Member, &context);
+        assert_eq!(result, Ok(AuthorizationDecision::Allow));
+    }
+
+    #[test]
+    fn member_denies_when_actor_is_not_member() {
+        let mut context = PolicyContext::new(Some(Actor::new("user123")), "Project", "project-1");
+        context.set_attribute("organization_id", "org-abc");
+        context.set_attribute("is_member", "false");
+        let result = PolicyEvaluator::evaluate(PolicySubject::Member, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
+    }
+
+    #[test]
+    fn member_denies_when_is_member_attribute_missing() {
+        let mut context = PolicyContext::new(Some(Actor::new("user123")), "Project", "project-1");
+        context.set_attribute("organization_id", "org-abc");
+        let result = PolicyEvaluator::evaluate(PolicySubject::Member, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
+    }
+
+    #[test]
+    fn member_denies_without_actor() {
+        let mut context = PolicyContext::new(None, "Project", "project-1");
+        context.set_attribute("organization_id", "org-abc");
+        context.set_attribute("is_member", "true");
+        let result = PolicyEvaluator::evaluate(PolicySubject::Member, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHENTICATED");
+    }
+
+    #[test]
+    fn member_denies_without_organization_id_attribute() {
+        let mut context = PolicyContext::new(Some(Actor::new("user123")), "Project", "project-1");
+        context.set_attribute("is_member", "true");
+        let result = PolicyEvaluator::evaluate(PolicySubject::Member, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "ORGANIZATION_NOT_DEFINED");
+    }
+
+    // Substrate tests for AuthorizationState (Phase 4A)
+    // These tests verify that RecordAuthorizationContext can carry authorization state
+    // and that the state provides read-only access to schema and snapshot.
+
+    fn make_stored_row(collection: &str, key: &str, value: Value) -> crate::StoredRow {
+        crate::StoredRow {
+            capability: format!("tenant:123:{}", collection),
+            key: key.into(),
+            rust_type: "json".into(),
+            value,
+            unix_ms: 0,
+            content_hash: None,
+            flow_ref: None,
+            deleted: false,
+            operation: None,
+        }
+    }
+
+    #[test]
+    fn record_context_without_state() {
+        let record = serde_json::json!({"_id": "rec1", "title": "Test"});
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("user1")),
+            "TestCollection",
+            "rec1",
+            record,
+        );
+        assert!(context.authorization_state.is_none());
+    }
+
+    #[test]
+    fn record_context_with_state_builder() {
+        use crate::state_contract::StateSchema;
+
+        let record = serde_json::json!({"_id": "rec1", "title": "Test"});
+        let schema = Arc::new(StateSchema {
+            contract_version: 1,
+            schema_version: 1,
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            collections: vec![],
+        });
+
+        let auth_state = AuthorizationState {
+            schema: schema.clone(),
+            state_namespace: "tenant:123".into(),
+            snapshot_rows: Arc::new(vec![]),
+        };
+
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("user1")),
+            "TestCollection",
+            "rec1",
+            record,
+        )
+        .with_state(auth_state.clone());
+
+        assert!(context.authorization_state.is_some());
+        assert_eq!(
+            context.authorization_state.unwrap().state_namespace,
+            "tenant:123"
+        );
+    }
+
+    #[test]
+    fn authorization_state_lookup_record() {
+        use crate::state_contract::StateSchema;
+
+        let schema = Arc::new(StateSchema {
+            contract_version: 1,
+            schema_version: 1,
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            collections: vec![],
+        });
+
+        let record1 = serde_json::json!({"_id": "id1", "name": "Alice"});
+        let stored_row = make_stored_row("Users", "id1", record1.clone());
+
+        let snapshot_rows = Arc::new(vec![stored_row]);
+        let state = AuthorizationState::new(schema, "tenant:123", snapshot_rows);
+
+        let found = state.lookup_record("Users", "id1");
+        assert_eq!(found, Some(record1));
+    }
+
+    #[test]
+    fn authorization_state_lookup_missing_record() {
+        use crate::state_contract::StateSchema;
+
+        let schema = Arc::new(StateSchema {
+            contract_version: 1,
+            schema_version: 1,
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            collections: vec![],
+        });
+
+        let snapshot_rows = Arc::new(vec![]);
+        let state = AuthorizationState::new(schema, "tenant:123", snapshot_rows);
+
+        let found = state.lookup_record("Users", "nonexistent");
+        assert_eq!(found, None);
+    }
+
+    #[test]
+    fn authorization_state_lookup_deleted_record() {
+        use crate::state_contract::StateSchema;
+
+        let schema = Arc::new(StateSchema {
+            contract_version: 1,
+            schema_version: 1,
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            collections: vec![],
+        });
+
+        let record1 = serde_json::json!({"_id": "id1", "name": "Alice"});
+        let mut stored_row = make_stored_row("Users", "id1", record1);
+        stored_row.deleted = true; // Mark as deleted
+
+        let snapshot_rows = Arc::new(vec![stored_row]);
+        let state = AuthorizationState::new(schema, "tenant:123", snapshot_rows);
+
+        let found = state.lookup_record("Users", "id1");
+        assert_eq!(found, None); // Deleted records are not visible
+    }
+
+    #[test]
+    fn authorization_state_records_in_collection() {
+        use crate::state_contract::StateSchema;
+
+        let schema = Arc::new(StateSchema {
+            contract_version: 1,
+            schema_version: 1,
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            collections: vec![],
+        });
+
+        let record1 = serde_json::json!({"_id": "id1", "name": "Alice"});
+        let record2 = serde_json::json!({"_id": "id2", "name": "Bob"});
+
+        let snapshot_rows = Arc::new(vec![
+            make_stored_row("Users", "id1", record1.clone()),
+            make_stored_row("Users", "id2", record2.clone()),
+        ]);
+
+        let state = AuthorizationState::new(schema, "tenant:123", snapshot_rows);
+        let records = state.records_in_collection("Users");
+
+        assert_eq!(records.len(), 2);
+        assert!(records.contains(&record1));
+        assert!(records.contains(&record2));
+    }
+
+    #[test]
+    fn existing_owner_policy_works_with_state() {
+        let record = serde_json::json!({"_id": "rec1", "owner_id": "user123"});
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("user123")),
+            "Project",
+            "rec1",
+            record,
+        );
+
+        // Should work even though authorization_state is None
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Owner, &context);
+        assert_eq!(result, Ok(AuthorizationDecision::Allow));
+    }
+
+    #[test]
+    fn existing_authenticated_policy_works_with_state() {
+        let record = serde_json::json!({"_id": "rec1"});
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("user123")),
+            "Project",
+            "rec1",
+            record,
+        );
+
+        // Should work even though authorization_state is None
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Authenticated, &context);
+        assert_eq!(result, Ok(AuthorizationDecision::Allow));
+    }
+
+    // Phase 4B: Member policy tests
+    // These tests verify that member policy is enforced using database state,
+    // not caller-supplied attributes.
+
+    fn make_schema_with_collections(collections: Vec<crate::state_contract::CollectionSchema>) -> Arc<crate::state_contract::StateSchema> {
+        Arc::new(crate::state_contract::StateSchema {
+            contract_version: 1,
+            schema_version: 1,
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            collections,
+        })
+    }
+
+    fn make_collection(name: &str, fields: Vec<crate::state_contract::FieldSchema>) -> crate::state_contract::CollectionSchema {
+        crate::state_contract::CollectionSchema {
+            name: name.into(),
+            version: 1,
+            fields,
+            indexes: vec![],
+        }
+    }
+
+    fn make_field(name: &str, field_type: crate::state_contract::FieldType) -> crate::state_contract::FieldSchema {
+        crate::state_contract::FieldSchema {
+            name: name.into(),
+            field_type,
+            nullable: false,
+            required: true,
+            default: None,
+            constraints: crate::state_contract::FieldConstraints::default(),
+            computed: None,
+        }
+    }
+
+    #[test]
+    fn member_policy_allows_authenticated_member() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user", FieldType::Reference { collection: "User".into() }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
+        let membership = serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
+
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+            make_stored_row("Membership", "mem1", membership),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1", "organization": "org1"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        assert_eq!(result, Ok(AuthorizationDecision::Allow));
+    }
+
+    #[test]
+    fn member_policy_denies_unauthenticated() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user", FieldType::Reference { collection: "User".into() }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
+        let membership = serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
+
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+            make_stored_row("Membership", "mem1", membership),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            None, // No actor
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1", "organization": "org1"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHENTICATED");
+    }
+
+    #[test]
+    fn member_policy_denies_non_member() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user", FieldType::Reference { collection: "User".into() }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
+        let membership = serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
+
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+            make_stored_row("Membership", "mem1", membership),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("bob")), // Different actor
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1", "organization": "org1"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
+    }
+
+    #[test]
+    fn member_policy_cross_org_isolation() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user", FieldType::Reference { collection: "User".into() }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+        ]);
+
+        // Alice is member of org1, project is in org2
+        let project = serde_json::json!({"_id": "proj1", "organization": "org2"});
+        let membership = serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
+
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+            make_stored_row("Membership", "mem1", membership),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1", "organization": "org2"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
+    }
+
+    #[test]
+    fn member_policy_no_state_fails() {
+        let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            project,
+        ); // No state attached
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "AUTHORIZATION_STATE_NOT_AVAILABLE");
+    }
+
+    #[test]
+    fn member_policy_missing_organization_reference() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                // No organization reference
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user", FieldType::Reference { collection: "User".into() }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1"});
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "ORGANIZATION_NOT_DEFINED");
+    }
+
+    #[test]
+    fn member_policy_missing_organization_field_in_record() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user", FieldType::Reference { collection: "User".into() }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1"}); // Missing organization field
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "ORGANIZATION_NOT_DEFINED");
+    }
+
+    #[test]
+    fn member_policy_deleted_membership_not_honored() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user", FieldType::Reference { collection: "User".into() }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
+        let mut membership = make_stored_row("Membership", "mem1",
+            serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"}));
+        membership.deleted = true; // Mark as deleted
+
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+            membership,
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1", "organization": "org1"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
+    }
+
+    #[test]
+    fn member_policy_multiple_memberships_finds_match() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user", FieldType::Reference { collection: "User".into() }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1", "organization": "org2"});
+
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+            make_stored_row("Membership", "mem1", serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"})),
+            make_stored_row("Membership", "mem2", serde_json::json!({"_id": "mem2", "user": "alice", "organization": "org2"})),
+            make_stored_row("Membership", "mem3", serde_json::json!({"_id": "mem3", "user": "bob", "organization": "org2"})),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1", "organization": "org2"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        assert_eq!(result, Ok(AuthorizationDecision::Allow));
+    }
+
+    #[test]
+    fn member_policy_spoofing_fake_is_member_attribute() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user", FieldType::Reference { collection: "User".into() }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1", "organization": "org1", "is_member": "true"});
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1", "organization": "org1", "is_member": "true"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        // Should deny because no actual membership record exists
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
+    }
+
+    #[test]
+    fn member_policy_spoofing_fake_organization_id() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user", FieldType::Reference { collection: "User".into() }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
+        let membership = serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
+
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+            make_stored_row("Membership", "mem1", membership),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+
+        // Caller tries to spoof a different organization
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1", "organization": "org2"}), // Spoofed org
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        // Should deny because actual record has org1, membership is for org1, but caller sent org2
+        // The authoritative record value is from the snapshot, not the caller's input
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
+    }
+
+    #[test]
+    fn member_policy_discovers_user_field_variations() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user_id", FieldType::Reference { collection: "User".into() }), // Variation: user_id not user
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
+        let membership = serde_json::json!({"_id": "mem1", "user_id": "alice", "organization": "org1"});
+
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+            make_stored_row("Membership", "mem1", membership),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1", "organization": "org1"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        // Should work because find_membership_fields looks for "User" references regardless of field name
+        // But wait - it looks for field names, not references. Let me check the implementation...
+        // Actually the test shows user_id references "User", so it should find it.
+        // But my implementation looks for the first Reference to User, so it will find user_id
+        assert_eq!(result, Ok(AuthorizationDecision::Allow));
+    }
+
+    #[test]
+    fn member_policy_spoofing_fake_role_attribute() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user", FieldType::Reference { collection: "User".into() }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1", "organization": "org1", "role": "admin"});
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1", "organization": "org1", "role": "admin"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        // Should deny because no actual membership record exists
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
+    }
+
+    #[test]
+    fn member_policy_no_membership_collection() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organization".into() }),
+            ]),
+            // No membership collection defined
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1", "organization": "org1"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "MEMBERSHIP_NOT_DEFINED");
+    }
+
+    #[test]
+    fn member_policy_handles_plural_collection_names() {
+        use crate::state_contract::FieldType;
+
+        let schema = make_schema_with_collections(vec![
+            make_collection("Project", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("organization", FieldType::Reference { collection: "Organizations".into() }), // Plural
+            ]),
+            make_collection("Membership", vec![
+                make_field("_id", FieldType::Primitive { primitive: crate::state_contract::PrimitiveType::String }),
+                make_field("user", FieldType::Reference { collection: "Users".into() }), // Plural
+                make_field("organization", FieldType::Reference { collection: "Organizations".into() }), // Plural
+            ]),
+        ]);
+
+        let project = serde_json::json!({"_id": "proj1", "organization": "org1"});
+        let membership = serde_json::json!({"_id": "mem1", "user": "alice", "organization": "org1"});
+
+        let snapshot = Arc::new(vec![
+            make_stored_row("Project", "proj1", project),
+            make_stored_row("Membership", "mem1", membership),
+        ]);
+
+        let auth_state = AuthorizationState::new(schema, "tenant:123", snapshot);
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("alice")),
+            "Project",
+            "proj1",
+            serde_json::json!({"_id": "proj1", "organization": "org1"}),
+        )
+        .with_state(auth_state);
+
+        let result = PolicyEvaluator::evaluate_record(PolicySubject::Member, &context);
+        assert_eq!(result, Ok(AuthorizationDecision::Allow));
+    }
+
+    // Tests for self() policy
+    #[test]
+    fn self_allows_when_field_matches_actor_id() {
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("user-bob")),
+            "Invitation",
+            "inv-1",
+            serde_json::json!({"_id": "inv-1", "user": "user-bob"}),
+        );
+
+        let result = PolicyEvaluator::evaluate_record(
+            PolicySubject::Self_ { field: "user".to_string() },
+            &context,
+        );
+        assert_eq!(result, Ok(AuthorizationDecision::Allow));
+    }
+
+    #[test]
+    fn self_denies_when_field_does_not_match_actor_id() {
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("user-bob")),
+            "Invitation",
+            "inv-1",
+            serde_json::json!({"_id": "inv-1", "user": "user-alice"}),
+        );
+
+        let result = PolicyEvaluator::evaluate_record(
+            PolicySubject::Self_ { field: "user".to_string() },
+            &context,
+        );
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHORIZED");
+    }
+
+    #[test]
+    fn self_denies_without_actor() {
+        let context = RecordAuthorizationContext::new(
+            None,
+            "Invitation",
+            "inv-1",
+            serde_json::json!({"_id": "inv-1", "user": "user-bob"}),
+        );
+
+        let result = PolicyEvaluator::evaluate_record(
+            PolicySubject::Self_ { field: "user".to_string() },
+            &context,
+        );
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "UNAUTHENTICATED");
+    }
+
+    #[test]
+    fn self_denies_when_field_is_missing() {
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("user-bob")),
+            "Invitation",
+            "inv-1",
+            serde_json::json!({"_id": "inv-1"}),
+        );
+
+        let result = PolicyEvaluator::evaluate_record(
+            PolicySubject::Self_ { field: "user".to_string() },
+            &context,
+        );
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "IDENTITY_NOT_FOUND");
+    }
+
+    #[test]
+    fn self_denies_when_field_is_null() {
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("user-bob")),
+            "Invitation",
+            "inv-1",
+            serde_json::json!({"_id": "inv-1", "user": null}),
+        );
+
+        let result = PolicyEvaluator::evaluate_record(
+            PolicySubject::Self_ { field: "user".to_string() },
+            &context,
+        );
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err().code, "IDENTITY_NOT_FOUND");
+    }
+
+    #[test]
+    fn self_works_with_different_field_names() {
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("user-alice")),
+            "APIKey",
+            "key-1",
+            serde_json::json!({"_id": "key-1", "owner": "user-alice"}),
+        );
+
+        let result = PolicyEvaluator::evaluate_record(
+            PolicySubject::Self_ { field: "owner".to_string() },
+            &context,
+        );
+        assert_eq!(result, Ok(AuthorizationDecision::Allow));
+    }
+
+    #[test]
+    fn self_denies_wrong_actor() {
+        let context = RecordAuthorizationContext::new(
+            Some(Actor::new("user-alice")),
+            "APIKey",
+            "key-1",
+            serde_json::json!({"_id": "key-1", "owner": "user-bob"}),
+        );
+
+        let result = PolicyEvaluator::evaluate_record(
+            PolicySubject::Self_ { field: "owner".to_string() },
+            &context,
+        );
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn policy_subject_parses_self_syntax() {
+        let subject = PolicySubject::from_str("self(user)");
+        assert!(matches!(subject, Some(PolicySubject::Self_ { field }) if field == "user"));
+    }
+
+    #[test]
+    fn policy_subject_parses_self_with_different_field() {
+        let subject = PolicySubject::from_str("self(owner)");
+        assert!(matches!(subject, Some(PolicySubject::Self_ { field }) if field == "owner"));
+    }
+
+    #[test]
+    fn policy_subject_as_str_for_self() {
+        let subject = PolicySubject::Self_ { field: "user".to_string() };
+        assert_eq!(subject.as_str(), "self");
+    }
+}