RBAC in code: the adapter whose rules are Elixir modules. A policy module, use Mediate.Rbac.Policy, declares the role table as data. Per protected schema it declares the grants that hold a role on its rows and the predicates every allowed row must satisfy. The predicates are functions in the same modules. The adapter takes no options (Mediate.Config), so its configuration entry is the bare module. It finds the policy and the repo through the binding Mediate.Rbac.Binding.bind/1 makes at boot beside the configuration.

Every answer is a query the repo runs at the time of the call. scope returns the rule as a dynamic over subqueries and runs nothing itself. The scope cap is :none. decide runs one query that selects each clause of the rule for the row asked about. So the reason names the clause that allowed or the clause that failed, and the clauses that held travel on the answer's meta. A deploy is a policy version, and publish/0 emits it as telemetry at boot.