Permissions

Permissions are the smallest unit of access. Each one grants or denies a specific action on a specific resource.

The model

A permission has five parts:

Field	Example	Purpose
resource	documents, billing, *	What is being accessed
action	read, write, delete, *	What operation
effect	allow or deny	Grant or block
scopeId	Workspace scope ID	Which scope it belongs to
conditions	{ team: "engineering" }	Optional ABAC constraints

Wildcards

Permission	What it matches
documents:read	Only documents:read
documents:*	Any action on documents
*:read	Read on any resource
*:*	Everything — super admin

Use documents:* to grant all actions on documents. Use *:* sparingly — it's full system access.

Allow vs deny

• allow — grants access. Use for most permissions.
• deny — blocks access. Deny wins over allow. A single deny at any scope level overrides every allow.

Creating a permission

cURL

curl -X POST https://api.wardenauthz.com/v1/scope/workspace-eng/permission \
  -H "x-api-key: YOUR_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "documents:read",
    "name": "Read Documents",
    "resource": "documents",
    "action": "read",
    "effect": "allow",
    "scopeId": "workspace-eng"
  }'

{
  "id": "documents:read",
  "resource": "documents",
  "action": "read",
  "effect": "allow",
  "scopeId": "workspace-eng",
  "name": "Read Documents"
}

TypeScript

import { WardenAuthClient } from '@ecarrizo2/wardenauthz-js'
const warden = new WardenAuthClient({ apiUrl: 'https://api.wardenauthz.com', apiKey: process.env.WARDEN_KEY })
await warden.permissions.create('workspace-eng', {
  id: 'documents:read',
  name: 'Read Documents',
  resource: 'documents',
  action: 'read',
  effect: 'allow',
})

Edge cases

• Permission IDs use resource:action format. The colon is URL-encoded as %3A in path segments.
• Wildcard permissions at the root scope override deny permissions in child scopes only if allowRoleInheritance is enabled on the child scope.
• Permissions are immutable after creation. To change one, delete and re-create.

In the dashboard

[Screenshot: Permission creation form with resource dropdown, action selector, and effect toggle]

Navigate to Permissions → New Permission. Pick a resource type, select an action, set allow or deny. The ID is auto-generated from resource:action.