the intended policy is "only the <owner> has can_r...
# spicedb
t
the intended policy is "only the has can_read permission on assets that are 'hidden'"