This content originally appeared on DEV Community and was authored by Kacper Zawojski | Zavcode
This is, in my opinion, Payload's most underrated feature.
An access function can return true/false — or it can return a Where object that Payload stitches into every query at the database level. That's row-level security, for free:
export const canReadPage: Access<Page> = ({ req: { user } }) => {
if (user) return true
// A guest only sees public documents — the filter goes to the DB, not to JS
return {
isPublic: { equals: true },
}
}
You don't fetch everything and then filter in memory — this Where becomes part of the WHERE clause in SQL (or $match in Mongo). And it works identically for read, update, and delete.
Once it clicks that access control is a constraint, not a gate, a whole class of "filter the user's own records" problems just disappears.
This content originally appeared on DEV Community and was authored by Kacper Zawojski | Zavcode
Kacper Zawojski | Zavcode | Sciencx (2026-06-05T19:12:17+00:00) Payload access control isn’t a boolean — it’s a query constraint. Retrieved from https://www.scien.cx/2026/06/05/payload-access-control-isnt-a-boolean-its-a-query-constraint/
Please log in to upload a file.
There are no updates yet.
Click the Upload button above to add an update.