Owning

An ownership declaration waiting to be told which routes it covers.

The chain ends in one of three, and the three read as what they are: all for a model nobody but its owner may even see, except for one whose reading routes are everybody's, only for the odd shape neither of those describes. There is no default, because "which routes does owning a row decide" has no safe silence: covering everything makes a blog's index private, and covering nothing makes the declaration do nothing at all.

These are not io.eezo.http.Guarded's only and except under another name, and the difference is worth saying twice. There the question is who has to be signed in. Here every covered route already needs a signed in user, and the question is which of them are narrowed to that user's own rows.