Filters records to those whose owner_ref equals the actor's (003 T050, FR-002, 012-FR-003).

The scope is compared, never interpreted

The actor arrives from the host and the library knows nothing about its shape beyond one thing: it may carry an owner reference. owner_ref/1 below is the entire extent of the library's knowledge, and it reads a field rather than deriving one — no splitting on :, no downcasing, no trimming.

Two owner references match when they are equal. That is the whole contract (012-FR-003). A library that normalised them would collapse two distinct owners whose references differ only in case, which is a tenant isolation failure produced by being helpful.

Unrecognised actors match nothing

An actor with no owner reference — nil, a bare atom, a struct with different fields — yields no filter that any record satisfies, so the read returns empty. Failing open here would make the policy a no-op for exactly the callers that got the actor shape wrong, which is the population most likely to be wrong about other things too.