Ownership Guard

Write canRead(record, user) — record is { id, ownerId, visibility } where visibility is "public" | "private"; user is { id, role } with role "admin" | "user". Return true when: record is public; OR the user owns it; OR the user is an admin. Otherwise false.

Difficulty: intermediate