Commit

Policy check before every fetch feels safer. but is that always the right call, or is there something else I should be considering with policies?

for single records and writes yes, for lists scope the query and check viewAny once, otherwise you're authorizing every row one by one 🙂