recordCan function

bool recordCan(
  1. ResourceRecord record,
  2. String ability
)

Whether the user may perform ability on this specific record.

Typed against ResourceRecord on purpose: a ResourceSchema's permissions block means capability ("this resource supports deletion and you are not categorically barred"), while a record's means authorization ("you may delete THIS row"). Under an ownership policy the two disagree for most records, and the class-level answer is permissive. Passing the wrong one is now a compile error rather than a silent escalation.

Implementation

bool recordCan(ResourceRecord record, String ability) => record.can(ability);