Maravilla Policies (Layer 2)

Maravilla enforces authorization in two layers:

• Layer 1 — tenant + owner isolation. Always on. Cannot be disabled. A request can never see another tenant's data.
• Layer 2 — per-resource policies. Declarative expressions you write in maravilla.config.ts. Evaluated on every KV / DB / realtime / media op against that resource. Configurable per-resource and toggleable per-request.

This skill is the reference for the Layer-2 expression language. For where policies are declared, see maravilla-config.

Where policies live