Every read of the document dashboard's widgets (MishkaDocument.Dashboard.Widgets) as the user viewing it, through the resource's own policies.

query/3 starts the read of a resource for the viewer:

• a master (a user whose site_id is nil) reads through the resource's master read — :master_read unless another is named — with no tenant, so it reads every site;
• a site user reads through the resource's primary :read with its own site as the tenant, so it reads that site alone.

Refine the query with filters, sorts, selects and loads, then run it with count/1 or list/2. The viewer is the query's actor, so the resource's policies decide what it reads: a viewer who does not hold the area a resource belongs to is refused, or has every row filtered out. Both run without raising and give a refused or failed read as no data — 0 from count/1, [] from list/2.

MishkaDocument.Issue
|> Scope.query(user)
|> Ash.Query.filter(status == :open)
|> Scope.count()

The viewer is required: MishkaCmsCore.Dashboard.Widget.scope/1 tells a master from a site user and raises on a missing user, which is never read as a master.