Payload access control isn't a boolean — it's a query constraint

This is, in my opinion, Payload's most underrated feature.

An access function can return true/false — or it can return a Where object that Payload stitches into every query at the database level. That's row-level security, for free:

export const canReadPage: Access<Page> = ({ req: { user } }) => {
  if (user) return true

  // A guest only sees public documents — the filter goes to the DB, not to JS
  return {
    isPublic: { equals: true },
  }
}

You don't fetch everything and then filter in memory — this Where becomes part of the WHERE clause in SQL (or $match in Mongo). And it works identically for read, update, and delete.

Once it clicks that access control is a constraint, not a gate, a whole class of "filter the user's own records" problems just disappears.