Skip to main content

Permission Evaluation

When hasAccess(subject, resource, action, scope) is called, the evaluator walks this flow:

Key Rules​

  • Deny wins. If any permission denies the resource/action, access is denied regardless of allow permissions.
  • Inheritance. Roles can inherit from parent roles. Access policies in parent scopes can be marked inheritable.
  • Wildcards. documents:* matches all actions on documents. *:* matches everything — use carefully.
  • ABAC conditions. Permissions can carry attribute-based conditions (user.department = 'engineering') evaluated at check time.