Scott Ganyo

Something like x-visibility or x-doc-visibility, maybe?

Isn't the "security" section for execution access control?

Right. What I'm saying is: The security section is already there for execution. We were talking about visibility. Why are you saying that we need an x-access to also control...

Well, I see several domains here: 1. Expression of an API as documentation 2. Authorization of access to sections of the API documentation 3. Expression of an API as executable...

It looks like this was reviewed and approved months ago, but is still marked as a draft. Should it be finalized and merged?

Coverage is calculated at a per-package level. Thus, coverage will not reflect cross-package testing like our use of ./cmd/... unit tests for integration testing.

It's unclear to me why there is a cascade option in [storage/delete.go](https://github.com/apigee/registry/blob/main/server/registry/internal/storage/delete.go). Would `cascade=false` not leave the database in an inconsistent state?

Sorry, I misread the intent: The `cascade` option is the same as the `force` field in [AIP-135](https://google.aip.dev/135#cascading-delete) - ie. If `cascade` is true, force delete the object and all its...

Ok, I think that's everything.

I'm not sure this is a good idea as it can potentially lead to a lot of concurrency issues in a heavily used database. Wipeout should perhaps be treated as...