Access control rules evaluate whether a user can perform an operation on a table or field. Read, write, create, and delete are separate operations. A user who can read incidents should not automatically be allowed to modify them. Consider required roles, conditions, and scripts when reviewing real-instance rules.
A list condition hides nonmatching records from that view; it doesn't protect those records through every route. UI policies and read-only controls also don't replace server authorization. Test access through the intended user's context, including direct record access and relevant integrations. This simulator uses a deliberately small table-and-operation role model. It teaches the boundary and exposes the rule definition without claiming to reproduce every production ACL inheritance and wildcard behavior. Use the vendor's complete access model for a real deployment.