OptionaldescriptionBare document ids (resource-local; both published and drafts. forms).
Caller-owned projected state the predicate reads as guard.metadata.*.
OptionalnameProvenance stamp — who registered the guard (the engine writes its own
marker here). Unenforced: nothing reads owner, and there is no
owner/admin modification rule — guard deploy/refresh/retract ride the
caller's token like every other engine write. A lake-enforced guard can
therefore lock the engine's own housekeeping out (self-lockout) until a
dedicated engine execution identity exists.
Lake delta-mode GROQ. The root exposes document.before,
document.after, mutation, and guard; identity() and resource-local
reference dereferencing are available. Empty string is unconditional deny.
The single datasource this guard belongs to — the engine spans datasources and must record which one, since the lake is per-datasource and infers the resource from storage.
Provenance — the workflow that registered this guard. The lake's own guard
model carries none of these; they exist so the engine can find its guards
for coherency refresh and housekeeping without parsing them out of _id.
The persisted body of a mutation guard — every field except the lake system fields. Shared by MutationGuardDoc (the stored doc) and the engine's compile inputs, so the field set lives in one place.