@@ -60,7 +60,7 @@ export const ContributorAccess = definePermissionSet({
 | `object` | `string` | Target object — or `'*'` to apply to every object |
 | `operation` | `'select' \| 'insert' \| 'update' \| 'delete' \| 'all'` | Which operation the policy guards. A `select` policy also bounds writes when no write-class policy applies — see below |
 | `using` | `string` | Predicate for rows the user may **see / act on** (compiled into the query filter) |
-| `check` | `string` | Predicate rows must satisfy **after a write**. Omit it and `using` is reused |
+| `check` | `string` | Predicate the new row must satisfy **after an insert or update**. Omit it and `using` stands in, unless another applicable policy for the same operation declares a `check` — see [the fail-closed contract](#the-fail-closed-contract) |
 | `positions` | `string[]` | Which positions the policy applies to. Omit = everyone |
 | `enabled` | `boolean` | Default `true`. `false` switches the policy off — a disabled policy is not evaluated |
 
@@ -202,7 +202,10 @@ Four ways a policy denies rather than leaks:
 2. A referenced context variable is missing, null, or an empty array → that
    policy drops out (it cannot match).
 3. A policy references a column the object doesn't have → deny.
-4. `check` is omitted → `using` is reused for writes, never "anything goes".
+4. `check` is omitted → `using` stands in as the write check. The choice is
+   made per operation across all the applicable policies, not policy by
+   policy: when any of them declares a `check`, only the declared checks
+   decide, and a USING-only sibling's `using` is not part of the write check.
 
 <Callout type="warn">
 **The one non-obvious case: no applicable policy means *no restriction*, not