PocketBase API Rules

Set the View, Update, and Delete rules to `author = @request.auth.id` so only the record's author can perform those actions. Leave List and View as an empty string if records should be publicly readable.

A locked (null) rule means only superusers can perform the action, while an empty string means everyone including guests can. This distinction is critical because an empty string unintentionally exposes data publicly.

Using `=` on multi-valued fields compares the raw JSON string instead of individual values. Use the `?=` operator (any/has) for multi-select, multi-relation, and multi-file fields to check individual elements.

Use the `@collection.*` macro, for example `@collection.memberships.user ?= @request.auth.id && @collection.memberships.team ?= team`. This performs an implicit EXISTS subquery, so add indexes on large datasets for performance.

Yes, use field modifiers in update rules. For example, `owner:changed = false` blocks modification of the owner field, and `@request.body.role:isset = false` prevents the role field from being sent at all.

Superusers always bypass API rules by design, so rules only apply to regular auth records and guests. Test permission logic with a regular user account rather than a superuser token to see actual rule behavior.