This is a great question. Real-world permissions was a core motivation for Zero.
The short answer is Zero security works just like traditional web app security. Reads flow through your server, and your server controls the queries that sync.
See zero.rocicorp.dev/docs/auth#pe...
