@spec can(subject(), Ash.Domain.t(), Ash.actor() | Ash.Scope.t(), Keyword.t()) ::
  {:ok, boolean() | :maybe}
  | {:ok, boolean(), term()}
  | {:ok, boolean(), Ash.Changeset.t(), Ash.Query.t()}
  | {:error, Ash.Error.t()}

Returns a an ok tuple if the actor can perform the action, query, or changeset, an error tuple if an error happens, and a ok tuple with maybe if maybe is set to true or not set.

You should prefer to use Ash.can/3 over this module, directly.

Note: maybe_is is set to :maybe, if not set.

@spec can?(subject(), Ash.Domain.t(), Ash.Resource.Record.t(), Keyword.t()) ::
  boolean() | no_return()

Returns whether an actor can perform an action, query, or changeset.

You should prefer to use Ash.can?/3 over this module, directly.

Can raise an exception if return_forbidden_error is truthy in opts or there's an error.

@spec can_do_all(checks(), Ash.actor() | Ash.Scope.t(), Keyword.t()) ::
  {:ok, [boolean() | :maybe] | map()} | {:error, Ash.Error.t()}

Returns whether an actor can perform each of the given actions.

You should prefer to use Ash.can_do_all/3 over this module, directly.

Returns {:ok, results} where results is a list (when checks is a list) or a map (when checks is a keyword list). Each value is true, false, or :maybe.

Each entry in checks is the same shape accepted by can/3, or {subject, opts} to provide per-check options. Per-check options are merged on top of the shared options, so values like tenant and context only need to be provided once.

@spec can_do_all?(checks(), Ash.actor() | Ash.Scope.t(), Keyword.t()) ::
  boolean() | no_return()

Returns whether an actor can perform all of the given actions.

You should prefer to use Ash.can_do_all?/3 over this module, directly.

Each entry in checks is the same shape accepted by can?/3, or {subject, opts} to provide per-check options. Per-check options are merged on top of the shared options, so values like tenant and context only need to be provided once.

When checks is a keyword list, use Ash.can_do_all/3 to get a map of results keyed by the provided names.

Can raise an exception if return_forbidden_error? is truthy in opts or there's an error.

@spec evaluate_field_policies(
  subject() | Ash.Resource.t(),
  Ash.Domain.t(),
  Ash.actor() | Ash.Scope.t(),
  [atom()],
  Keyword.t()
) ::
  {:ok, %{required(atom()) => boolean() | {:filter, term()}}}
  | {:error, Ash.Error.t()}

Evaluates field policies for the given fields in the context of the given action, query, or changeset, without needing any records in hand.

You should prefer to use Ash.can_see_fields?/4 or Ash.can_see_fields/4 over this module, directly.

Returns {:ok, results} where each requested field maps to true, false, or {:filter, expr} when its visibility depends on the record it is read from (i.e its field policies use filter checks).

When a record is provided via the :data option (or the subject is a {record, read_action} tuple), record-dependent fields are instead resolved by evaluating their filters against that record. With run_queries?: false, filters that cannot be resolved from the record's in-memory values remain {:filter, expr} for the caller to collapse.