Teams

_teams and _team_members model workspace membership as ordinary collections. Scoping an app collection to a team is a rule, not a new primitive: @collection._team_members.team = @collection._team_members.team && userId = @request.auth.id-style expressions (see Filter syntax) express “only members of this record’s team” using the same rule engine every other access-control decision goes through.