Skipping validations when calling `Ash.can?`

Ash can has a bunch of options that you can pass:

Maybe :run_queries? or :reuse_values? or :validate? can help you out?

Using Ash.can? for UI permission checks can definitely become costly when heavy validations run each time. The common approach is to build a lightweight changeset and pass a context flag so your expensive validations are skipped during pure authorization checks. It’s not the most elegant pattern, but for now it’s the idiomatic way to separate validation from permission logic in Ash.

I deal with similar workflow issues in my bail bonds tampa operations, where systems must run fast and avoid unnecessary validations during routine checks—so skipping heavy rules during “read-only” permission queries is often the only practical solution.

Yes, I saw and tried those options. One would think that :validate? did exactly that, but it does a completely different thing.

I think I will go for the context flag, and maybe a helper module like this:

defmodule MyApp.NotAnAuthCheck do
  use Ash.Resource.Validation

  @impl true
  def supports(_opts), do: [Ash.Changeset]

  @impl true
  def validate(_changeset, _opts, context) do
    if context.source_context[:_authorization_check] do
      {:error, message: "This is an authorization check"}
    else
      :ok
    end
  end
end

to be used like this:

validate {MyExpensiveValidation, field: :my_field}, where: MyApp.NotAnAuthCheck

Thanks for your inputs!

@jack_m, assume you have implemented Ash.Policy.SimpleCheck like ash-phoenix-starter/lib/ash_phoenix_starter/accounts/checks/authorize.ex at master · kamaroly/ash-phoenix-starter · GitHub.

I would call the match?/3 function directly. This would skip validations.