Update access rule

Change readers (200, applies on the next request) or sealed (202 with the rule and a job). add_readers and remove_readers edit the list under a row lock: removes first, then adds.