access: authorization at the API

Every request is judged by the registry the node holds: store reads
pruned to what the user may read, writes refused where it may not,
admin endpoints by protocol capabilities. Without a registry, as
before (--protocol-writers for protocol data).

Auth plan M1.

1 files changed, 4 insertions, 2 deletions

diff --git a/docs/dashboard.md b/docs/dashboard.md
index 3ac587b..9879fb5 100644
--- a/docs/dashboard.md
+++ b/docs/dashboard.md
@@ -273,8 +273,10 @@ to the whole swarm like any other:
 * **`+` on a list's row** inserts an item at an index (`-1`: at the end); the items
   from there on move up.
 
-Protocol data (`_continuum`) is written only by users in `--protocol-writers`, and epoch
-metadata and the swarm ID by nobody ([`trust.md`](trust.md)). A key containing `/`, or an empty
+Each user sees and edits what its capabilities let it ([`access.md`](access.md)): of a part it
+may only partly read, the keys on the way to what it may. Protocol data (`_continuum`)
+is written only by users given it (in a swarm without a user registry, those in
+`--protocol-writers`), and epoch metadata and the swarm ID by nobody ([`trust.md`](trust.md)). A key containing `/`, or an empty
 key, is listed but can't be opened.
 In the protocol data, values and keys get the same readings as in the figures: the
 aliases of node IDs (a member's entry, a vote, a coordinator), times and sizes.