AZ105: A rule written wrongly

Under rules schema.table, each line is a command and an expression: select : view, insert : edit, update : edit, delete : owner. Only update rules name columns or say when they are checked: update owner_id : share (who may change that column), update after : edit (checked on the row after the change; check was its old name). A plain update rule is checked on the row before and after the change, so update before : is refused. A column named before or after says when it is checked: update after after : edit. Masks are mask col1, col2 : expression.

Reported when the policy is compiled: rowfence check, the editor, rowfence dev.

The mistake

app role app_user
type user = app.users
type folder = app.folders
  owner : user = owner_id
  can edit = owner
rules app.folders
  select owner_id : edit

line 7: only update rules can name columns, 'before' or 'after' (got: select owner_id) [AZ105]

Fixed

app role app_user
type user = app.users
type folder = app.folders
  owner : user = owner_id
  can edit = owner
rules app.folders
  select : edit
  update : edit
  update owner_id : edit