@sixb/core 0.1.20 → 0.1.22

package/src/execution/authorized-object-reader.ts

@@ -1,19 +1,14 @@
 import { assertNever } from "../assert-never"
-import { assertAuthorized, isAllowed } from "../authorization"
+import { isRuntimeAllowed } from "../authorization"
 import { AuthorizationError } from "../authorization/errors"
-import type { AuthorizationContext } from "../authorization/types"
 import type { EmbeddingModelCatalog, RerankingModelCatalog } from "../models/catalog"
+import type { AuthorizedOntologyView } from "../objects/authorized-ontology-view"
 import {
-  type AuthorizedOntologySelection,
-  type AuthorizedOntologyView,
-  createAuthorizedOntologyView,
-} from "../objects/authorized-ontology-view"
-import {
-  createClearanceQueryAdmission,
-  type PropertyClearance,
+  attachRedactions,
+  omitHiddenProperties,
   redactObjectRow,
-  resolvePropertyClearance,
-} from "../objects/property-clearance"
+} from "../objects/clearance-redaction"
+import { unreadableError } from "../objects/property-clearance"
 import {
   countObjects,
   type ExecuteObjectCountInput,
@@ -31,14 +26,14 @@ import {
   existsObjects,
   facetObjects,
 } from "../objects/query"
+import { createClearanceQueryAdmission } from "../objects/query/clearance-admission"
 import { ObjectQueryValidationError } from "../objects/query/errors"
-import { validateObjectFacetRequests } from "../objects/query/executor"
-import type { ObjectQuery } from "../objects/query/ir"
+import { type QueryExecutorOptions, validateObjectFacetRequests } from "../objects/query/executor"
+import type { ObjectQuery, ObjectQueryPredicate } from "../objects/query/ir"
+import { assertLinkQueryReadable } from "../objects/query/link-query-clearance"
 import { preflightObjectQueryLinks } from "../objects/query/links"
-import {
-  createSelectedObjectQueryAdmission,
-  type SelectedObjectQueryAdmission,
-} from "../objects/query/selected-read-admission"
+import { normalizeObjectQuery } from "../objects/query/normalize"
+import { userExpansionPlan } from "../objects/query/user-expansions"
 import {
   type AdmittedObjectQuery,
   composeObjectQueryAdmissions,
@@ -52,8 +47,9 @@ import {
   type TelemetryHistoryReadWorkloadInput,
 } from "../objects/telemetry/workload"
 import type { OntologyRegistry } from "../ontology"
+import type { AppliedMarkings } from "../security/applied-markings"
 import type {
-  CompiledObjectReadStep,
+  AuthUserStore,
   LinkBatchKey,
   ObjectFacetRequest,
   ObjectLinkRow,
@@ -63,17 +59,21 @@ import type {
 } from "../storage"
 import { assertObjectReadOutputWithinLimit, MAX_OBJECT_READ_FACETS } from "../storage"
 import { captureExecutionScope, resolveExecutionScopeAuthorization } from "./authorization"
-import type { ExecutionScope, RuntimeAuthorization } from "./types"
+import type { Clearance, EventSources } from "./object-reader-clearance"
+import { ObjectReaderOntology } from "./object-reader-ontology"
+import { ObjectReaderSecurity } from "./object-reader-security"
+import { attachUserProfiles } from "./object-reader-users"
+import type { ExecutionScope } from "./types"
+import { uniqueLookupKey } from "./unique-lookup"
 
-type RuntimeReadAuthorization = {
-  readonly projectId: string
-  readonly runtimeAuthorization: RuntimeAuthorization
-  readonly authorization?: AuthorizationContext
-}
-
-type ResolvedExecutionAuthority = ReturnType<typeof resolveExecutionScopeAuthorization>
 type GetObjectInput = Omit<Parameters<ObjectReadStorage["getByPrimaryId"]>[0], "projectId">
 type GetObjectsInput = Omit<Parameters<ObjectReadStorage["getByPrimaryIdBatch"]>[0], "projectId">
+/** A caller's value, validated and keyed against the property's schema. */
+interface GetByUniqueValueInput {
+  readonly objectTypeId: string
+  readonly propertyId: string
+  readonly value: unknown
+}
 type SelectObjectPropertiesInput = Parameters<ObjectReadStorage["selectsObjectProperties"]>[0]
 type CanReadObjectPropertyInput = SelectObjectPropertiesInput["items"][number]
 type CanReadObjectPropertiesBatchInput = Omit<SelectObjectPropertiesInput, "projectId">
@@ -81,6 +81,12 @@ type ListObjectsInput = Omit<Parameters<ObjectReadStorage["list"]>[0], "projectI
 type ListLinksInput = Omit<Parameters<ObjectReadStorage["listLinks"]>[0], "projectId">
 type ListLinksBatchInput = Omit<Parameters<ObjectReadStorage["listLinksBatch"]>[0], "projectId">
 
+/** The model catalogs semantic and reranked search use. */
+interface ObjectReaderModels {
+  readonly embedding?: EmbeddingModelCatalog
+  readonly reranking?: RerankingModelCatalog
+}
+
 const readerConstructionKey = Object.freeze({})
 
 /**
@@ -89,91 +95,88 @@ const readerConstructionKey = Object.freeze({})
  * The implementation class is intentionally private to this module. Its private fields make the
  * exported instance type nominal, while the construction key prevents code that discovers the
  * JavaScript constructor through an instance from manufacturing another reader.
+ *
+ * Its state is grouped as a project is: the ontology it resolves against, the security of the
+ * authority (its delegation and clearance included), the model catalogs search uses, and the
+ * storage it reads, with the member directory that expanded user properties resolve against.
+ * Each group decides what belongs to it; the reader composes them.
  */
 class AuthorizedObjectReaderImpl {
-  readonly #authorization: RuntimeAuthorization
-  readonly #authority: ResolvedExecutionAuthority
-  readonly #runtime: RuntimeReadAuthorization
-  readonly #ontology: OntologyRegistry
-  readonly #embeddingModels?: EmbeddingModelCatalog
-  readonly #rerankingModels?: RerankingModelCatalog
-  #ontologyView?: AuthorizedOntologyView
+  readonly #ontology: ObjectReaderOntology
+  readonly #security: ObjectReaderSecurity
+  readonly #models: ObjectReaderModels
   readonly #storage: ObjectReadStorage
-  readonly #delegatedObjectTypeIds?: ReadonlySet<string>
-  readonly #delegatedLinkDefinitions?: ReadonlySet<string>
-  readonly #delegatedQueryAdmission?: SelectedObjectQueryAdmission
-  /** Marked properties this authority cannot read; absent when it reads every property. */
-  readonly #clearance?: PropertyClearance
+  readonly #users: AuthUserStore | undefined
 
   constructor(
     key: typeof readerConstructionKey,
     input: {
-      readonly scope: ExecutionScope
-      readonly ontology: OntologyRegistry
-      readonly embeddingModels?: EmbeddingModelCatalog
-      readonly rerankingModels?: RerankingModelCatalog
+      readonly ontology: ObjectReaderOntology
+      readonly security: ObjectReaderSecurity
+      readonly models: ObjectReaderModels
       readonly storage: ObjectReadStorage
-      readonly authority: ResolvedExecutionAuthority
+      readonly users?: AuthUserStore
     }
   ) {
     if (key !== readerConstructionKey) {
       throw new Error("[Sixb] AuthorizedObjectReader can only be created by Core.")
     }
-
-    this.#authorization = input.scope.authorization
-    this.#authority = input.authority
     this.#ontology = input.ontology
-    this.#embeddingModels = input.embeddingModels
-    this.#rerankingModels = input.rerankingModels
+    this.#security = input.security
+    this.#models = input.models
     this.#storage = input.storage
-    this.#delegatedObjectTypeIds =
-      input.authority.type === "delegated"
-        ? new Set(input.authority.objectRead.scope.objects.map((object) => object.objectTypeId))
-        : undefined
-    this.#delegatedLinkDefinitions =
-      input.authority.type === "delegated"
-        ? new Set(input.authority.objectRead.scope.steps.map(delegatedLinkDefinitionKey))
-        : undefined
-    this.#delegatedQueryAdmission =
-      input.authority.type === "delegated"
-        ? createSelectedObjectQueryAdmission(input.authority.objectRead.scope)
-        : undefined
-    this.#clearance = clearanceForAuthority(input.authority, input.ontology)
-    this.#runtime = Object.freeze({
-      projectId: input.scope.execution.projectId,
-      runtimeAuthorization: input.scope.authorization,
-      ...(input.authority.type === "principal" ? { authorization: input.authority.context } : {}),
-    })
+    this.#users = input.users
   }
 
   static assertBound(reader: AuthorizedObjectReaderImpl, scope: ExecutionScope): void {
     const capturedScope = captureExecutionScope(scope)
-    resolveExecutionScopeAuthorization(reader.#runtime.projectId, capturedScope)
-    if (capturedScope.authorization !== reader.#authorization) {
+    resolveExecutionScopeAuthorization(reader.#security.runtime.projectId, capturedScope)
+    if (capturedScope.authorization !== reader.#security.authorization) {
       throw new Error(
         "[Sixb] AuthorizedObjectReader is not bound to this exact execution authority."
       )
     }
   }
 
+  /** What the reader cannot read now, for surfaces such as events that redact on their own. */
+  static async clearance(reader: AuthorizedObjectReaderImpl): Promise<Clearance> {
+    return reader.#security.clearance.current()
+  }
+
+  /** What the reader cannot read in an object event. */
+  static eventClearance(
+    reader: AuthorizedObjectReaderImpl,
+    sources: EventSources
+  ): Clearance | Promise<Clearance> {
+    return reader.#security.clearance.forEvent(sources)
+  }
+
+  /** The conditions the reader views object types through, by concrete type. */
+  static viewConditions(
+    reader: AuthorizedObjectReaderImpl
+  ): ReadonlyMap<string, ReaderViewCondition> {
+    const security = reader.#security
+    const conditions = security.conditionalScope?.conditions ?? []
+
+    return new Map(
+      conditions.map(({ objectTypeId, predicate }) => [
+        objectTypeId,
+        {
+          predicate,
+          hiddenBy: (clearance: Clearance) =>
+            !security.isObjectTypeViewable(objectTypeId, clearance),
+        },
+      ])
+    )
+  }
+
   static ontologyView(reader: AuthorizedObjectReaderImpl): AuthorizedOntologyView {
-    const authority = reader.#authority
-    reader.#ontologyView ??= createAuthorizedOntologyView({
-      ontology: reader.#ontology,
-      selection: ontologySelectionForAuthority(authority, reader.#ontology),
-      ...(authority.type === "delegated"
-        ? {
-            assertOutputWithinLimit: (value: unknown) =>
-              assertObjectReadOutputWithinLimit(value, authority.objectRead.limits),
-          }
-        : {}),
-    })
-    return reader.#ontologyView
+    return reader.#ontology.view()
   }
 
   /** Project identity carried by this nominal reader capability. */
   get projectId(): string {
-    return this.#runtime.projectId
+    return this.#security.runtime.projectId
   }
 
   async getByPrimaryId(input: GetObjectInput): ReturnType<ObjectReadStorage["getByPrimaryId"]> {
@@ -181,12 +184,52 @@ class AuthorizedObjectReaderImpl {
       objectTypeId: input.objectTypeId,
       primaryId: input.primaryId,
     })
-    this.#assertObjectTypesViewable([request.objectTypeId])
+    const clearance = await this.#security.clearance.current()
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)
     const row = await this.#storage.getByPrimaryId({
       ...request,
-      projectId: this.#runtime.projectId,
+      projectId: this.#security.runtime.projectId,
     })
-    return detachReadResult(row && this.#redact(row))
+    return this.#detachRows(
+      row && this.#omitHidden(row, clearance),
+      (detached) => [detached],
+      clearance
+    )
+  }
+
+  /**
+   * The object of exactly `objectTypeId` holding a unique property's value, or null. A lookup by a
+   * marked property would reveal its value, so it needs the clearance a query predicate needs.
+   */
+  async getByUniqueValue(input: GetByUniqueValueInput): Promise<ObjectRow | null> {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      propertyId: input.propertyId,
+      value: input.value,
+    })
+    const clearance = await this.#security.clearance.current()
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)
+
+    const valueKey = uniqueLookupKey(this.#ontology.registry, request)
+    const marking = clearance?.missingMarking(request.objectTypeId, request.propertyId)
+    if (marking !== undefined) {
+      throw new AuthorizationError(
+        `clearance:marking:${marking}`,
+        `[Sixb] Cannot look up '${request.objectTypeId}.${request.propertyId}' by value: it requires clearance for marking '${marking}'.`
+      )
+    }
+
+    const row = await this.#storage.getByUniqueValue({
+      objectTypeId: request.objectTypeId,
+      propertyId: request.propertyId,
+      valueKey,
+      projectId: this.#security.runtime.projectId,
+    })
+    return this.#detachRows(
+      row && this.#omitHidden(row, clearance),
+      (detached) => [detached],
+      clearance
+    )
   }
 
   async getByPrimaryIdBatch(
@@ -198,13 +241,19 @@ class AuthorizedObjectReaderImpl {
         primaryId: item.primaryId,
       })),
     })
-    this.#assertObjectTypesViewable(request.items.map((item) => item.objectTypeId))
+    const clearance = await this.#security.clearance.current()
+    this.#security.assertObjectTypesViewable(
+      request.items.map((item) => item.objectTypeId),
+      clearance
+    )
     const rows = await this.#storage.getByPrimaryIdBatch({
       ...request,
-      projectId: this.#runtime.projectId,
+      projectId: this.#security.runtime.projectId,
     })
-    return detachReadResult(
-      new Map([...rows].map(([key, row]) => [key, this.#redact(row)] as const))
+    return this.#detachRows(
+      new Map([...rows].map(([key, row]) => [key, this.#omitHidden(row, clearance)] as const)),
+      (detached) => detached.values(),
+      clearance
     )
   }
 
@@ -214,14 +263,12 @@ class AuthorizedObjectReaderImpl {
       primaryId: input.primaryId,
       propertyId: input.propertyId,
     })
-    this.#assertObjectTypesViewable([request.objectTypeId])
-    if (this.#hidesProperty(request)) return false
-    if (this.#authority.type !== "delegated") return true
-    const [readable] = await this.#storage.selectsObjectProperties({
-      projectId: this.#runtime.projectId,
-      items: [request],
-    })
-    return readable ?? false
+    const clearance = await this.#security.clearance.current()
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)
+
+    if (hidesProperty(request, clearance)) return false
+    const [selected] = await this.#selectsObjectProperties([request])
+    return selected ?? false
   }
 
   async canReadObjectPropertiesBatch(
@@ -234,16 +281,14 @@ class AuthorizedObjectReaderImpl {
         propertyId: item.propertyId,
       })),
     })
-    this.#assertObjectTypesViewable(request.items.map((item) => item.objectTypeId))
-    const selected =
-      this.#authority.type === "delegated"
-        ? await this.#storage.selectsObjectProperties({
-            ...request,
-            projectId: this.#runtime.projectId,
-          })
-        : request.items.map(() => true)
+    const clearance = await this.#security.clearance.current()
+    this.#security.assertObjectTypesViewable(
+      request.items.map((item) => item.objectTypeId),
+      clearance
+    )
+    const selected = await this.#selectsObjectProperties(request.items)
     return request.items.map(
-      (item, index) => !this.#hidesProperty(item) && selected[index] === true
+      (item, index) => !hidesProperty(item, clearance) && selected[index] === true
     )
   }
 
@@ -266,7 +311,8 @@ class AuthorizedObjectReaderImpl {
       orderBy: input.orderBy,
       order: input.order,
     })
-    const objectTypeId = this.#resolveListObjectTypes(request.objectTypeId)
+    const clearance = await this.#security.clearance.current()
+    const objectTypeId = this.#resolveListObjectTypes(request.objectTypeId, clearance)
 
     // An empty type selection means "none", never "all". Short-circuiting here prevents a
     // provider with different empty-array semantics from turning a principal read into a broad one.
@@ -277,9 +323,13 @@ class AuthorizedObjectReaderImpl {
     const page = await this.#storage.list({
       ...request,
       ...(objectTypeId === undefined ? {} : { objectTypeId }),
-      projectId: this.#runtime.projectId,
+      projectId: this.#security.runtime.projectId,
     })
-    return detachReadResult({ ...page, objects: page.objects.map((row) => this.#redact(row)) })
+    return this.#detachRows(
+      { ...page, objects: page.objects.map((row) => this.#omitHidden(row, clearance)) },
+      (detached) => detached.objects,
+      clearance
+    )
   }
 
   async listLinks(input: ListLinksInput): ReturnType<ObjectReadStorage["listLinks"]> {
@@ -289,14 +339,15 @@ class AuthorizedObjectReaderImpl {
       linkId: input.linkId,
       direction: input.direction,
     })
-    this.#assertObjectTypesViewable([request.objectTypeId])
+    const clearance = await this.#security.clearance.current()
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)
     const links = detachReadResult(
       await this.#storage.listLinks({
         ...request,
-        projectId: this.#runtime.projectId,
+        projectId: this.#security.runtime.projectId,
       })
     )
-    return links.filter((link) => this.#isLinkViewable(link))
+    return links.filter((link) => this.#security.isLinkViewable(link, clearance))
   }
 
   async listLinksBatch(
@@ -310,18 +361,22 @@ class AuthorizedObjectReaderImpl {
         linkId: item.linkId,
       })),
     })
-    this.#assertObjectTypesViewable(request.items.map((item) => item.objectTypeId))
+    const clearance = await this.#security.clearance.current()
+    this.#security.assertObjectTypesViewable(
+      request.items.map((item) => item.objectTypeId),
+      clearance
+    )
     const pages = detachReadResult(
       await this.#storage.listLinksBatch({
         ...request,
-        projectId: this.#runtime.projectId,
+        projectId: this.#security.runtime.projectId,
       })
     )
     const filtered = new Map<LinkBatchKey, ObjectLinkRow[]>()
     for (const [key, links] of pages) {
       filtered.set(
         key,
-        links.filter((link) => this.#isLinkViewable(link))
+        links.filter((link) => this.#security.isLinkViewable(link, clearance))
       )
     }
     return filtered
@@ -333,16 +388,24 @@ class AuthorizedObjectReaderImpl {
     const query = snapshotAuthoredQuery(input.query)
     const includeTotal = snapshotReadValue(input.includeTotal)
     const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query
+    const clearance = await this.#security.clearance.current()
     const result = await executeObjectQuery(
       {
         query: executionQuery,
         ...(includeTotal === undefined ? {} : { includeTotal }),
-        projectId: this.#runtime.projectId,
+        projectId: this.#security.runtime.projectId,
         signal: input.signal,
       },
-      this.#queryExecutorOptions()
+      this.#queryExecutorOptions(clearance)
     )
-    return detachReadResult({ ...result, objects: result.objects.map((row) => this.#redact(row)) })
+    const detached = this.#detachRows(
+      { ...result, objects: result.objects.map((row) => this.#omitHidden(row, clearance)) },
+      (detached) => detached.objects,
+      clearance
+    )
+
+    await this.#attachUsers(detached.objects, query)
+    return detached
   }
 
   async queryLinks(
@@ -357,15 +420,15 @@ class AuthorizedObjectReaderImpl {
       pageToken: input.pageToken,
     })
     let executionQuery = query
-    const admission = this.#delegatedQueryAdmission
+    const admission = this.#security.delegation?.queryAdmission
     if (admission) {
       const preflight = preflightObjectQueryLinks(
-        { query, ...request, projectId: this.#runtime.projectId },
-        { ontology: this.#ontology }
+        { query, ...request, projectId: this.#security.runtime.projectId },
+        { ontology: this.#ontology.registry }
       )
       const admitted = validateObjectQueryWithAdmission(
         preflight.validated.query,
-        { ontology: this.#ontology, normalize: false },
+        { ontology: this.#ontology.registry, normalize: false },
         admission
       )
       admission.assertIncidentEdgeSelected({
@@ -376,10 +439,23 @@ class AuthorizedObjectReaderImpl {
       })
       executionQuery = admitted.query
     }
+
+    const clearance = await this.#security.clearance.current()
+    if (clearance) {
+      assertLinkQueryReadable({
+        ontology: this.#ontology.registry,
+        clearance,
+        query,
+        request: { ...request, projectId: this.#security.runtime.projectId },
+        viewableByGrants: (objectTypeId) =>
+          this.#security.isObjectTypeViewable(objectTypeId, undefined),
+      })
+    }
+
     const result = detachReadResult(
       await executeObjectQueryLinks(
-        { query: executionQuery, ...request, projectId: this.#runtime.projectId },
-        this.#queryExecutorOptions()
+        { query: executionQuery, ...request, projectId: this.#security.runtime.projectId },
+        this.#queryExecutorOptions(clearance)
       )
     )
 
@@ -387,12 +463,18 @@ class AuthorizedObjectReaderImpl {
     // its cursor and hasMore metadata describe hidden rows, so a provider contract violation must
     // fail closed instead of returning a partially filtered page.
     if (
-      result.objects.some((row) => !this.#isObjectTypeViewable(row.objectTypeId)) ||
-      result.links.some((link) => !this.#isLinkViewable(link))
+      result.objects.some(
+        (row) => !this.#security.isObjectTypeViewable(row.objectTypeId, clearance)
+      ) ||
+      result.links.some((link) => !this.#security.isLinkViewable(link, clearance))
     ) {
       throw new Error("[Sixb] Object storage returned a link page outside its authorized scope.")
     }
-    return { ...result, objects: result.objects.map((row) => this.#redact(row)) }
+
+    return {
+      ...result,
+      objects: result.objects.map((row) => (clearance ? redactObjectRow(row, clearance) : row)),
+    }
   }
 
   async count(
@@ -400,10 +482,11 @@ class AuthorizedObjectReaderImpl {
   ): Promise<ExecuteObjectCountResult> {
     const query = snapshotAuthoredQuery(input.query)
     const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query
+    const clearance = await this.#security.clearance.current()
     return detachReadResult(
       await countObjects(
-        { query: executionQuery, projectId: this.#runtime.projectId },
-        this.#queryExecutorOptions()
+        { query: executionQuery, projectId: this.#security.runtime.projectId },
+        this.#queryExecutorOptions(clearance)
       )
     )
   }
@@ -413,10 +496,11 @@ class AuthorizedObjectReaderImpl {
   ): Promise<ExecuteObjectExistsResult> {
     const query = snapshotAuthoredQuery(input.query)
     const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query
+    const clearance = await this.#security.clearance.current()
     return detachReadResult(
       await existsObjects(
-        { query: executionQuery, projectId: this.#runtime.projectId },
-        this.#queryExecutorOptions()
+        { query: executionQuery, projectId: this.#security.runtime.projectId },
+        this.#queryExecutorOptions(clearance)
       )
     )
   }
@@ -428,17 +512,17 @@ class AuthorizedObjectReaderImpl {
     const facets = snapshotFacetRequests(input.facets)
     let executionQuery = query
     let executionFacets = facets
-    const admission = this.#delegatedQueryAdmission
+    const admission = this.#security.delegation?.queryAdmission
     if (admission) {
       // Terminal arguments are ordinary validation errors, not an authorization oracle. Validate
       // them against the canonical result shape before raising any delegated-scope denial.
-      const validated = validateObjectQuery(query, { ontology: this.#ontology })
+      const validated = validateObjectQuery(query, { ontology: this.#ontology.registry })
       const normalizedFacets = validateObjectFacetRequests(facets, validated.result.objectTypeIds, {
-        ontology: this.#ontology,
+        ontology: this.#ontology.registry,
       })
       const admitted = validateObjectQueryWithAdmission(
         validated.query,
-        { ontology: this.#ontology, normalize: false },
+        { ontology: this.#ontology.registry, normalize: false },
         admission
       )
       normalizedFacets.forEach((facet, index) => {
@@ -452,63 +536,142 @@ class AuthorizedObjectReaderImpl {
       executionQuery = admitted.query
       executionFacets = normalizedFacets
     }
+    const clearance = await this.#security.clearance.current()
     return detachReadResult(
       await facetObjects(
         {
           query: executionQuery,
           facets: executionFacets,
-          projectId: this.#runtime.projectId,
+          projectId: this.#security.runtime.projectId,
         },
-        this.#queryExecutorOptions()
+        this.#queryExecutorOptions(clearance)
       )
     )
   }
 
   /**
-   * Redact a row returned by a write. An upsert returns the merged effective row, which may hold
-   * marked values the writer never sent and cannot read.
+   * Redact the rows a write of this object type returns. An upsert returns the merged effective
+   * row, which may hold marked values the writer never sent and cannot read. Resolved before the
+   * write, which it refuses when the writer cannot read the type at all.
    */
-  redactWrittenRow<TRow extends ObjectRow>(row: TRow): TRow {
-    return this.#redact(row)
+  async writtenRowRedactor(
+    objectTypeId: string
+  ): Promise<<TRow extends ObjectRow>(row: TRow) => TRow> {
+    const clearance = await this.#security.clearance.current()
+    assertTargetsReadable(clearance, { objectTypeIds: [objectTypeId] })
+    return (row) => (clearance ? redactObjectRow(row, clearance) : row)
+  }
+
+  /**
+   * The check a direct write runs on each object's properties before its commit claims them. It
+   * refuses a value for a unique property this authority cannot read: whether the write is refused
+   * as taken would reveal which values objects hold, as a `getBy` would.
+   */
+  async uniqueValueWriteCheck(
+    objectTypeId: string
+  ): Promise<(properties: Readonly<Record<string, unknown>>) => void> {
+    const clearance = await this.#security.clearance.current()
+    const marked = this.#ontology.registry
+      .listUniqueProperties(objectTypeId)
+      .flatMap((property) => {
+        const marking = clearance?.missingMarking(objectTypeId, property.propertyId)
+        return marking === undefined ? [] : [{ propertyId: property.propertyId, marking }]
+      })
+
+    return (properties) => {
+      for (const { propertyId, marking } of marked) {
+        if (properties[propertyId] === undefined || properties[propertyId] === null) continue
+
+        throw new AuthorizationError(
+          `clearance:marking:${marking}`,
+          `[Sixb] Cannot write a value to '${objectTypeId}.${propertyId}': it is unique and requires clearance for marking '${marking}'.`
+        )
+      }
+    }
+  }
+
+  /**
+   * Refuse a write or a request that names an object type or link this authority cannot read,
+   * before any lookup: it would answer whether what it names exists, and land where the reader
+   * cannot see.
+   */
+  async assertReadable(targets: ReadTargets): Promise<void> {
+    assertTargetsReadable(await this.#security.clearance.current(), targets)
+  }
+
+  /**
+   * Whether this reader sees only the objects of a type that a condition matches. A write or a
+   * request that names such an object finds it through this reader first: one it cannot find is
+   * hidden or missing, and both answer alike.
+   */
+  viewsThroughCondition(objectTypeId: string): boolean {
+    return this.#security.viewsThroughCondition(objectTypeId)
+  }
+
+  /** Refuse a type this reader views neither whole nor through a condition. */
+  async assertViewable(objectTypeIds: readonly string[]): Promise<void> {
+    const clearance = await this.#security.clearance.current()
+    this.#security.assertObjectTypesViewable(objectTypeIds, clearance)
   }
 
   /** Enforce the delegated response budget without exposing or recombining its limits. */
   assertVisibleOutputWithinLimit(value: unknown): void {
-    if (this.#authority.type !== "delegated") return
-    assertObjectReadOutputWithinLimit(value, this.#authority.objectRead.limits)
+    if (this.#security.authority.type !== "delegated") return
+    assertObjectReadOutputWithinLimit(value, this.#security.authority.objectRead.limits)
   }
 
   /** Admit adjacent telemetry work without exposing which authority policy was selected. */
   admitTelemetryHistoryRead(
     input: TelemetryHistoryReadWorkloadInput
   ): TelemetryHistoryReadAdmission {
-    return admitTelemetryHistoryReadWorkload(input, this.#authority.type === "delegated")
+    return admitTelemetryHistoryReadWorkload(input, this.#security.authority.type === "delegated")
   }
 
-  #queryExecutorOptions() {
-    const admission = this.#executorAdmission()
-    if (this.#authority.type === "delegated") {
+  #queryExecutorOptions(clearance: Clearance) {
+    const admission = this.#executorAdmission(clearance)
+
+    if (this.#security.authority.type === "delegated") {
       // The selected storage instance is the private execution capability. Passing the delegated
       // runtime token into the generic executor would either reject this admitted query or tempt a
       // forgeable bypass flag; neither is needed at this nominal boundary.
       return {
-        ontology: this.#ontology,
+        ontology: this.#ontology.registry,
         storage: this.#storage,
-        embeddingModels: this.#embeddingModels,
-        rerankingModels: this.#rerankingModels,
+        embeddingModels: this.#models.embedding,
+        rerankingModels: this.#models.reranking,
         ...(admission === undefined ? {} : { admission }),
+        requestingUser: this.#security.requestingUser,
       }
     }
     return {
-      ontology: this.#ontology,
-      embeddingModels: this.#embeddingModels,
-      rerankingModels: this.#rerankingModels,
+      ontology: this.#ontology.registry,
+      embeddingModels: this.#models.embedding,
+      rerankingModels: this.#models.reranking,
       storage: this.#storage,
-      runtimeAuthorization: this.#runtime.runtimeAuthorization,
-      ...(this.#runtime.authorization === undefined
-        ? {}
-        : { authorization: this.#runtime.authorization }),
+      ...this.#queryAuthorization(clearance),
       ...(admission === undefined ? {} : { admission }),
+      requestingUser: this.#security.requestingUser,
+    }
+  }
+
+  /**
+   * A principal's queries read the types this reader's security grants, including those its
+   * storage reads through a condition, which no view grant holds.
+   */
+  #queryAuthorization(
+    clearance: Clearance
+  ): Pick<QueryExecutorOptions, "readableObjectTypes" | "runtimeAuthorization"> {
+    const runtimeAuthorization = this.#security.runtime.runtimeAuthorization
+    if (this.#security.authority.type !== "principal") return { runtimeAuthorization }
+
+    const security = this.#security
+    return {
+      runtimeAuthorization,
+      readableObjectTypes: Object.freeze({
+        assert: (objectTypeIds: readonly string[]) =>
+          security.assertObjectTypesGranted(objectTypeIds, clearance),
+        has: (objectTypeId: string) => security.isObjectTypeGranted(objectTypeId, clearance),
+      }),
     }
   }
 
@@ -516,84 +679,102 @@ class AuthorizedObjectReaderImpl {
    * The executor validates the query it runs, and that validation resolves default text fields.
    * Every admission that narrows those fields must therefore apply there, not only beforehand.
    */
-  #executorAdmission(): ObjectQuerySemanticAdmission | undefined {
-    const clearance = this.#clearance && createClearanceQueryAdmission(this.#clearance)
-    const selected = this.#delegatedQueryAdmission
-    if (selected && clearance) return composeObjectQueryAdmissions(selected, clearance)
-    return selected ?? clearance
+  #executorAdmission(clearance: Clearance): ObjectQuerySemanticAdmission | undefined {
+    const admission = clearance && createClearanceQueryAdmission(clearance)
+    const selected = this.#security.delegation?.queryAdmission
+
+    if (selected && admission) return composeObjectQueryAdmissions(selected, admission)
+    return selected ?? admission
   }
 
-  #redact<TRow extends ObjectRow>(row: TRow): TRow {
-    return this.#clearance ? redactObjectRow(row, this.#clearance) : row
+  /**
+   * Resolve the user properties the query expands on rows already detached and redacted. Only an
+   * authority that may view the directory reads profiles; a delegated one never does.
+   */
+  async #attachUsers(rows: readonly ObjectRow[], query: ObjectQuery): Promise<void> {
+    const plan = userExpansionPlan(normalizeObjectQuery(query))
+    if (!plan) return
+
+    await attachUserProfiles({
+      rows,
+      plan,
+      ontology: this.#ontology.registry,
+      projectId: this.#security.runtime.projectId,
+      canViewUsers: isRuntimeAllowed(this.#security.runtime, { kind: "users.view" }),
+      users: this.#users,
+    })
   }
 
-  #hidesProperty(item: { readonly objectTypeId: string; readonly propertyId: string }): boolean {
-    return this.#clearance?.hiddenPropertyIds(item.objectTypeId).has(item.propertyId) ?? false
+  /**
+   * Whether the reader's storage selects each property of its object. A delegated reader selects
+   * what its share does. A principal reads a type it views through a condition object by object,
+   * so a hidden object and a missing one both select nothing; it selects every other property.
+   */
+  async #selectsObjectProperties(
+    items: readonly CanReadObjectPropertyInput[]
+  ): Promise<readonly boolean[]> {
+    const readsByObject = (item: CanReadObjectPropertyInput) =>
+      this.#security.authority.type === "delegated" ||
+      this.#security.viewsThroughCondition(item.objectTypeId)
+
+    const checked = items.filter(readsByObject)
+    const selected =
+      checked.length === 0
+        ? []
+        : await this.#storage.selectsObjectProperties({
+            projectId: this.#security.runtime.projectId,
+            items: checked,
+          })
+
+    let next = 0
+    return items.map((item) => !readsByObject(item) || selected[next++] === true)
   }
 
-  #admitDelegatedQuery(query: ObjectQuery): AdmittedObjectQuery | undefined {
-    if (!this.#delegatedQueryAdmission) return undefined
-    return validateObjectQueryWithAdmission(
-      query,
-      { ontology: this.#ontology },
-      this.#delegatedQueryAdmission
-    )
+  #omitHidden<TRow extends ObjectRow>(row: TRow, clearance: Clearance): TRow {
+    return clearance ? omitHiddenProperties(row, clearance) : row
   }
 
-  #assertObjectTypesViewable(objectTypeIds: readonly string[]): void {
-    if (this.#authority.type === "delegated") {
-      for (const objectTypeId of new Set(objectTypeIds)) {
-        if (this.#delegatedObjectTypeIds?.has(objectTypeId)) continue
-        throw new AuthorizationError(
-          `delegated:object.view:${objectTypeId}`,
-          `[Sixb] Delegated authorization does not select object type '${objectTypeId}'.`
-        )
-      }
-      return
+  /**
+   * Detach a result whose rows went through {@link #omitHidden}, then list their redactions on
+   * the copy. Each row is deep-copied once, and never with a hidden value.
+   */
+  #detachRows<TResult>(
+    result: TResult,
+    rows: (detached: TResult) => Iterable<ObjectRow | null>,
+    clearance: Clearance
+  ): TResult {
+    const detached = detachReadResult(result)
+    if (clearance) {
+      for (const row of rows(detached)) if (row) attachRedactions(row, clearance)
     }
 
-    for (const objectTypeId of new Set(objectTypeIds)) {
-      assertAuthorized(this.#runtime, { kind: "object.view", objectTypeId })
-    }
+    return detached
+  }
+
+  #admitDelegatedQuery(query: ObjectQuery): AdmittedObjectQuery | undefined {
+    const admission = this.#security.delegation?.queryAdmission
+    if (!admission) return undefined
+    return validateObjectQueryWithAdmission(query, { ontology: this.#ontology.registry }, admission)
   }
 
   #resolveListObjectTypes(
-    requested: ListObjectsInput["objectTypeId"]
+    requested: ListObjectsInput["objectTypeId"],
+    clearance: Clearance
   ): ListObjectsInput["objectTypeId"] {
     if (requested !== undefined) {
       const objectTypeIds = typeof requested === "string" ? [requested] : [...new Set(requested)]
       for (const objectTypeId of objectTypeIds) {
-        this.#ontology.resolveObjectType(objectTypeId)
+        this.#ontology.registry.resolveObjectType(objectTypeId)
       }
-      this.#assertObjectTypesViewable(objectTypeIds)
+      this.#security.assertObjectTypesViewable(objectTypeIds, clearance)
       return typeof requested === "string" ? requested : objectTypeIds
     }
 
-    if (this.#authority.type === "unrestricted") return undefined
-    return this.#ontology
+    if (this.#security.authority.type === "unrestricted") return undefined
+    return this.#ontology.registry
       .listObjectTypes()
       .map((objectType) => objectType.id)
-      .filter((objectTypeId) => this.#isObjectTypeViewable(objectTypeId))
-  }
-
-  #isObjectTypeViewable(objectTypeId: string): boolean {
-    if (this.#authority.type === "delegated") {
-      return this.#delegatedObjectTypeIds?.has(objectTypeId) ?? false
-    }
-    return isAllowed(this.#runtime.authorization, { kind: "object.view", objectTypeId })
-  }
-
-  #isLinkViewable(link: ObjectLinkRow): boolean {
-    if (
-      !this.#isObjectTypeViewable(link.sourceTypeId) ||
-      !this.#isObjectTypeViewable(link.targetTypeId)
-    ) {
-      return false
-    }
-    return (
-      this.#delegatedLinkDefinitions?.has(delegatedLinkDefinitionKey(link)) ??
-      this.#authority.type !== "delegated"
-    )
+      .filter((objectTypeId) => this.#security.isObjectTypeViewable(objectTypeId, clearance))
   }
 }
 
@@ -609,18 +790,32 @@ export function createAuthorizedObjectReader(input: {
   readonly embeddingModels?: EmbeddingModelCatalog
   readonly rerankingModels?: RerankingModelCatalog
   readonly objectStorage: ObjectStorage
+  /** Markings of the dataset versions projections applied; the code's markings alone without. */
+  readonly appliedMarkings?: AppliedMarkings
+  /** The member directory expanded user properties resolve against. */
+  readonly users?: AuthUserStore
 }): AuthorizedObjectReader {
   const scope = captureExecutionScope(input.scope)
   const projectId = scope.execution.projectId
   const authority = resolveExecutionScopeAuthorization(projectId, scope)
-  const storage = objectStorageForAuthority(authority, input.objectStorage)
-  const reader = new AuthorizedObjectReaderImpl(readerConstructionKey, {
-    scope,
+  const security = new ObjectReaderSecurity({
+    authorization: scope.authorization,
+    authority,
+    projectId,
     ontology: input.ontology,
-    embeddingModels: input.embeddingModels,
-    rerankingModels: input.rerankingModels,
+    ...(input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings }),
+    requestedBy: scope.execution.requestedBy,
+  })
+  const storage = objectStorageForAuthority(security, input.objectStorage)
+  const reader = new AuthorizedObjectReaderImpl(readerConstructionKey, {
+    ontology: new ObjectReaderOntology(input.ontology, security),
+    security,
+    models: Object.freeze({
+      ...(input.embeddingModels === undefined ? {} : { embedding: input.embeddingModels }),
+      ...(input.rerankingModels === undefined ? {} : { reranking: input.rerankingModels }),
+    }),
     storage,
-    authority,
+    ...(input.users === undefined ? {} : { users: input.users }),
   })
   Object.freeze(reader)
   return reader
@@ -640,29 +835,89 @@ export function getAuthorizedOntologyView(reader: AuthorizedObjectReader): Autho
 }
 
 /**
- * Unrestricted authority reads every property. A principal reads what its roles clear; delegated
- * shared access carries no clearance, so no share can expose a marked property.
+ * What a reader resolved for this authority cannot read now. Events redact with it: an event of an
+ * object type the reader cannot read is not delivered, and the others are redacted like rows.
  */
-function clearanceForAuthority(
-  authority: ResolvedExecutionAuthority,
-  ontology: OntologyRegistry
-): PropertyClearance | undefined {
-  switch (authority.type) {
-    case "unrestricted":
-      return undefined
-    case "principal":
-      return resolvePropertyClearance(ontology, authority.context.clearances ?? new Set())
-    case "delegated":
-      return resolvePropertyClearance(ontology, new Set())
+export function readerClearance(reader: AuthorizedObjectReader): Promise<Clearance> {
+  return AuthorizedObjectReaderImpl.clearance(reader)
+}
+
+/**
+ * What a reader cannot read in an object event: the current markings, with those of the versions
+ * its values came from. A plain value for a reader those markings cannot affect, which reads no
+ * version.
+ */
+export function readerEventClearance(
+  reader: AuthorizedObjectReader,
+  sources: EventSources
+): Clearance | Promise<Clearance> {
+  return AuthorizedObjectReaderImpl.eventClearance(reader, sources)
+}
+
+/** A condition a reader views an object type through, for a surface that decides per object. */
+export interface ReaderViewCondition {
+  /** The condition, `currentUser()` bound, as the reader's storage reads it. */
+  readonly predicate: ObjectQueryPredicate
+  /**
+   * Whether a clearance hides the type, or a property the condition reads: which objects match
+   * would reveal it, so the reader reads no object of the type.
+   */
+  hiddenBy(clearance: Clearance): boolean
+}
+
+/**
+ * The conditions a reader views object types through, by concrete type: empty for a reader that
+ * views each type it reads whole. A type absent here is decided by its grants alone, which deny a
+ * type viewed only under a condition. Events match the state they carry against these, and read
+ * through the reader what they cannot decide from it.
+ */
+export function readerViewConditions(
+  reader: AuthorizedObjectReader
+): ReadonlyMap<string, ReaderViewCondition> {
+  return AuthorizedObjectReaderImpl.viewConditions(reader)
+}
+
+/** What a write or a request names: object types, and links by their source type. */
+interface ReadTargets {
+  readonly objectTypeIds: readonly string[]
+  readonly links?: readonly { readonly objectTypeId: string; readonly linkId: string }[]
+}
+
+function assertTargetsReadable(clearance: Clearance, targets: ReadTargets): void {
+  if (!clearance) return
+
+  for (const objectTypeId of targets.objectTypeIds) {
+    const unreadable = clearance.unreadableType(objectTypeId)
+    if (unreadable) throw unreadableError(unreadable)
   }
+
+  for (const link of targets.links ?? []) {
+    const unreadable = clearance.unreadableLink(link.objectTypeId, link.linkId)
+    if (unreadable) throw unreadableError(unreadable)
+  }
+}
+
+function hidesProperty(
+  item: { readonly objectTypeId: string; readonly propertyId: string },
+  clearance: Clearance
+): boolean {
+  return clearance?.missingMarking(item.objectTypeId, item.propertyId) !== undefined
 }
 
 function objectStorageForAuthority(
-  authority: ResolvedExecutionAuthority,
+  security: ObjectReaderSecurity,
   objectStorage: ObjectStorage
 ): ObjectReadStorage {
+  const authority = security.authority
+
   switch (authority.type) {
     case "principal":
+      return security.conditionalScope
+        ? objectStorage.createConditionalReadScope({
+            projectId: authority.projectId,
+            scope: security.conditionalScope,
+          })
+        : objectStorage
     case "unrestricted":
       return objectStorage
     case "delegated":
@@ -679,41 +934,6 @@ function objectStorageForAuthority(
   }
 }
 
-function ontologySelectionForAuthority(
-  authority: ResolvedExecutionAuthority,
-  ontology: OntologyRegistry
-): AuthorizedOntologySelection {
-  switch (authority.type) {
-    case "unrestricted":
-      return { kind: "all" }
-    case "principal":
-      return {
-        kind: "types",
-        objectTypeIds: ontology
-          .listObjectTypes()
-          .filter((objectType) =>
-            isAllowed(authority.context, {
-              kind: "object.view",
-              objectTypeId: objectType.id,
-            })
-          )
-          .map((objectType) => objectType.id),
-      }
-    case "delegated":
-      return { kind: "selected", scope: authority.objectRead.scope }
-  }
-}
-
-function delegatedLinkDefinitionKey(
-  input:
-    | Pick<CompiledObjectReadStep, "sourceObjectTypeId" | "linkId" | "targetObjectTypeId">
-    | Pick<ObjectLinkRow, "sourceTypeId" | "linkId" | "targetTypeId">
-): string {
-  return "sourceObjectTypeId" in input
-    ? JSON.stringify([input.sourceObjectTypeId, input.linkId, input.targetObjectTypeId])
-    : JSON.stringify([input.sourceTypeId, input.linkId, input.targetTypeId])
-}
-
 /**
  * Storage providers may optimize trusted reads with live references. Values crossing the
  * application-facing authorization boundary must not retain them.