# `MishkaCmsCore.Accounts.Checks.AccountWithheld`
[🔗](https://github.com/mishka-group/mishka_cms_core/blob/v0.0.1/lib/mishka_cms_core/accounts/__checks/account_withheld.ex#L5)

True while what an account holds — its site, its permissions — is reached from that account by a
caller who may not see it. Two ways reach it:

  * a load, when the account itself was reached through another resource — a comment's author, a
    post's blogger — by someone who is not an admin. `MishkaCmsCore.Accounts.User` marks such a
    read with `mark/1`; the mark is shared context, so Ash carries it into that account's own
    loads.
  * a filter, a sort or an aggregate through the account — `?filter[author][permissions][name]=`
    — which Ash authorizes hop by hop without loading anything, so no mark is there. Only an admin
    matches against what an account holds; everyone else asks nothing of it.

An admin here is a holder of the user area on the request's surface (`admin:<surface>:user`), the
same who read an account's own fields. The resources an account holds refuse under it with a filter
policy of their own, so a load answers with nothing and a filter matches nothing, rather than
failing the request:

    policies do
      policy MishkaCmsCore.Accounts.Checks.AccountWithheld do
        forbid_if always()
      end

      # ...
    end

# `eager_evaluate?`

# `init`

# `mark`

```elixir
@spec mark(Ash.Query.t()) :: Ash.Query.t()
```

Marks a User read so that the account's own relationships are refused under it.

# `prefer_expanded_description?`

# `requires_original_data?`

# `strict_check`

# `type`

---

*Consult [api-reference.md](api-reference.md) for complete listing*