The Data Model
The data model is described as a JSON schema on github in the webcom-components/reach-schema repo.
See https://webcom-components.github.io/reach-schema/#draft-00 to visualize the data model used in Reach.
The corresponding Security Rules can be found here.
You will need to import those rules in order to enforce security in your application. Take a look at the test results to understand these rules.