A script that may write

One script may write tenant data, and another may not.

app billing "Billing" {}

script score compute js """
export function compute(ctx) {
  return ctx.record.total;
}
"""

script reconcile action using db read, write js """
export function runAction(ctx) {
  return db.transaction(() => {
    db.from("Note").insert({ invoice: ctx.record_id, body: "Reconciled" });
    return { effects: [{ kind: "refresh" }] };
  });
}
"""

entity Invoice {
  total: number

  workflow {
    initial Open
    states Open, Closed
    terminal Closed

    close: Open -> Closed {
      do run script reconcile
    }
  }
}

A body that calls db with no using db grant is effect/script-grant-missing, and a script that only reads the record it was handed leaves the grant off.