Does SurrealDB permission evaluation impact result set counts in aggregate queries?

Record-Level Permission Filtering

SurrealDB utilizes DEFINE TABLE and DEFINE FIELD statements to implement fine-grained access control. These permissions are evaluated during the query execution phase, effectively acting as a filter on the records returned to the user based on the authenticated session's properties.

Consistency in Aggregations

When executing aggregate functions—such as count() or sum()—on a table with complex record-level permissions, there is a need to understand how the engine handles the filtered result set. Specifically, it is unclear if the aggregation occurs before or after the permission filter is applied to the underlying data.

• Does the count() function return the total number of records in the table or only the records the user is permitted to see?
• Which behavior is expected when a user has permission to perform an aggregate operation but lacks permission to read individual records within that set?