3 files changed, 5 insertions, 3 deletions
diff --git a/Digitigrade/Model/FetchableModel.php b/Digitigrade/Model/FetchableModel.php
index 6d21f40..3efa763 100644
--- a/Digitigrade/Model/FetchableModel.php
+++ b/Digitigrade/Model/FetchableModel.php
@@ -2,6 +2,7 @@
 namespace Digitigrade\Model;
 
 use Digitigrade\Model;
+use Digitigrade\PolicyManager;
 use Digitigrade\RemoteFetchable;
 
 abstract class FetchableModel extends Model implements RemoteFetchable {
@@ -75,7 +76,7 @@ abstract class FetchableModel extends Model implements RemoteFetchable {
         $obj = static::createFromJson($data, $autoSave, $uri);
 
         $obj->finaliseAfterFetch($uri);
-        if (!$obj->validate()) {
+        if (!$obj->validate() || !PolicyManager::getInstance()->check($obj)) {
             return null; // and don't save
         }
         if ($autoSave) {
diff --git a/Digitigrade/Model/Note.php b/Digitigrade/Model/Note.php
index f3c0901..880e3e8 100644
--- a/Digitigrade/Model/Note.php
+++ b/Digitigrade/Model/Note.php
@@ -20,7 +20,7 @@ class Note extends PushableModel implements TimelineIncludeable, Notifyable {
     public Actor $author;
     public ?string $summary;
     public string $plainContent;
-    // associative array mapping strings to strings - mimetypes to content
+    /** @var array associative array mapping strings to strings - mimetypes to content */
     public array $formattedContent = [];
     public string $language;
     /**
diff --git a/Digitigrade/Model/PushableModel.php b/Digitigrade/Model/PushableModel.php
index 271b313..e773779 100644
--- a/Digitigrade/Model/PushableModel.php
+++ b/Digitigrade/Model/PushableModel.php
@@ -2,6 +2,7 @@
 namespace Digitigrade\Model;
 
 use Digitigrade\Job\PushObject;
+use Digitigrade\PolicyManager;
 
 abstract class PushableModel extends FetchableModel implements \JsonSerializable {
     public ?int $id;
@@ -20,7 +21,7 @@ abstract class PushableModel extends FetchableModel implements \JsonSerializable
         }
 
         $obj = static::createFromJson($data, $autoSave);
-        if (!$obj->validate()) {
+        if (!$obj->validate() || !PolicyManager::getInstance()->check($obj)) {
             return null; // and don't save
         }
         if ($autoSave) {