Entity Permissions

Entity Permissions attach permission-key grants to a specific resource instance. A grant assigns a named operation to a User, Role, or Department.

A resource that uses these grants lists the Entity Permissions capability in its Model Definition. The resource documentation defines its permission keys, direct or inherited mode, accepted request fields, and endpoint-specific effects.

Grant Structure

Each Entity Permission contains:

• key: The resource-specific permission key.

• permission_entity and permission_entity_id: The user, role, or department receiving the grant.

• target_entity and target_entity_id: The resource instance controlled by the grant.

Direct and Inherited Permissions

Direct Entity Permissions belong to the resource instance itself. A directly controlled resource can expose an entityPermissions relation and documented create or update endpoints can accept entity_permissions.

Inherited Entity Permissions are evaluated through a documented parent resource. A dependent resource does not own independent grants unless its Model Definition also declares direct Entity Permissions.

Permission Enforcement

Module Permissions determine whether the authenticated user's role can use a module or operation. Entity Permissions then restrict access to individual resource instances. Ownership and administration rules can provide documented alternatives.

Restricted Scope defines how direct and inherited Entity Permissions filter queries and authorize operations.

Relationship to Targetables

Targetables select users or departments as participants, recipients, or responsible parties. They do not grant permission keys. A resource can support either or both concepts, and its Model Definition documents their effects separately.