What an App serves

An App serves the resources it declares and nothing else of its connection; the connection and, with sign-in, the roles decide what of them can be read.

resources: {
  ticket: { access: 'write', delete: true },   // New, Save and Delete on tickets
  customer: { access: 'read' },                 // read, never written
  region: {},                                   // read: a label a ticket shows
},

Only what it declares

Signed in or not, with roles or without:

• a table the App does not declare is not there: no address, no metadata, and every endpoint answers for it as for a table that does not exist; nav only arranges what is declared;
• raw SQL, saved SQL, the schema browser, the layout and page builders and the connection manager are the database browser’s, and an App has none of them. The standalone browser (tablewalk <db>, no App) is the tool for the tables an App does not curate;
• tablewalk check names a view or page that reads past the declared resources (an App without roles has one reader, so it would be an empty room for everyone).

Without auth, every column of every declared resource is sent to any browser that reaches the port, password hashes included, except a column the resource lists in hidden or the connection hides in tablewalk.json. So keep the server on loopback (the default), or put sign-in or a proxy in front of it: secrets.

access, fields, hidden and delete

Key	Without auth.roles	With auth and auth.roles
(the resource block)	Declares it: it reads. {} is enough.	Declares it; roles read what access ceilings.
access: 'read' | 'write'	Once any resource declares one, only 'write' resources are written.	The ceiling roles grant within.
delete: true	Offers Delete; beside a declared ceiling it needs access: 'write'.	The same, for roles that write it.
fields: { read, write }	Refused: “a column ceiling for signed-in roles”.	Columns outside it are left out of metadata and results; a query naming one is refused.
hidden: [...]	Never served: cut from metadata and results, a query naming one is refused.	The same, for every role; no grant gives it back.

With no access declared at all, every declared resource writes where the connection allows. authority.lock records which case an App is in (scope resources, scope ceilings or scope roles) and, without roles, each resource it reads.

Read-only is the connection’s

Every read runs in a read-only transaction, and nothing writes unless the connection says "writable": true in tablewalk.json; the adapter enforces it, whatever the App declares. tablewalk check --routes lists a New form for each resource the App could create, including on a read-only connection, where saving it is refused.

Sign-in, role grants, row policies and signed-out reads: Sign-in, roles & data.