access: a node registers before it writes

Under a policy, a change by a node that isn't a member is refused with
all built on it: a node's registration is written before any write of
its own or through the API, not after (the registration itself
exempt).

Auth plan M6 (fix).

1 files changed, 2 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index 0366e26..fa0b47d 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -194,7 +194,8 @@ revocation since refuses nothing it allowed then, and every node judges alike.
 * A user's tokens revoked by that user too (logging out).
 * Everything else, protocol data or not, by a user the registry lets write there.
 * A node that isn't a member may only register itself; a banned node nothing (Banning
-  a node, below).
+  a node, below). So a node registers before anything else it writes, through the API
+  or its own: a change refused stays out with every change built on it.
 
 With `"signatures": "required"`, a change also needs a signature by the node it names
 ([`api.md`](api.md), Signed changes): every node then signs every change it makes, and