access: the policy enforced

_continuum/access/policy ({"version": 1}) has every node screen every
change it receives, on every path changes come in. A policy a node
doesn't know stops its writes through the API. GET /admin/refused.

Auth plan M6.

1 files changed, 4 insertions, 1 deletions

diff --git a/docs/trust.md b/docs/trust.md
index 70369e2..5444b8b 100644
--- a/docs/trust.md
+++ b/docs/trust.md
@@ -57,7 +57,10 @@ Protect the configuration like the swarm key.
 ## What members are trusted with
 
 Everything in the document. A member syncs changes to and from its peers, and every
-node acts on what the document says:
+node acts on what the document says. Unless the swarm has a policy
+([`access.md`](access.md), Changes judged on every node): then every node judges every
+change it receives by rules by path, and those below are refused where a change breaks
+them, as far as the node and user a change claims are who wrote it:
 
 * **User data**: any member can write or delete any path.
 * **Who wrote what** (`GET /admin/changes`): each change names its node and API user