Access rules on every row

Every catalog resource has one owner, at most one owner group and one Mode. Reads are filtered by it: an anonymous caller sees only rows whose “other” class may view; a signed-in caller also sees the rows it owns or its group can view.

Writes need an auth role that allows writing at all (or break-glass admin status) and then pass the Mode check on the row. Break-glass admins are granted by Yellow Pages itself, not by the identity provider.