True while what an account holds — its site, its permissions — is reached from that account by a caller who may not see it. Two ways reach it:

• a load, when the account itself was reached through another resource — a comment's author, a post's blogger — by someone who is not an admin. MishkaCmsCore.Accounts.User marks such a read with mark/1; the mark is shared context, so Ash carries it into that account's own loads.
• a filter, a sort or an aggregate through the account — ?filter[author][permissions][name]= — which Ash authorizes hop by hop without loading anything, so no mark is there. Only an admin matches against what an account holds; everyone else asks nothing of it.

An admin here is a holder of the user area on the request's surface (admin:<surface>:user), the same who read an account's own fields. The resources an account holds refuse under it with a filter policy of their own, so a load answers with nothing and a filter matches nothing, rather than failing the request:

policies do
  policy MishkaCmsCore.Accounts.Checks.AccountWithheld do
    forbid_if always()
  end

  # ...
end