Permissions

Entity-scoped, group-based access control — PermissibleEntity, PermissionEvaluator, GroupEvaluator, visibility flags, and the full decision matrix.

PermissibleEntity

kotlin

PermissionAction

Action	Purpose
`VIEW`	See the entity exists and read its fields
`LIST`	Entity appears in list/search results
`EDIT`	Modify the entity
`MANAGE`	Grant/revoke permissions (implies EDIT)
`DELETE`	Soft-delete the entity
`EXECUTE`	Trigger workflow transitions
`IMPERSONATE`	Act as another principal in this context

The Decision Chain

When isAllowed(authentication, entity, action) is called:

Deleted check — if entity.isDeleted, only SA gets access.
Public access — if public and published/advertised, VIEW is granted. If publicList and published/advertised, LIST is granted.
Editor group — editor group members get EDIT access globally.
Entity-level permissions — checks user's groups against EntityPermission records. MANAGE also satisfies EDIT.
Role-based fallback — SA and admin get all actions. Editors get everything except MANAGE, EXECUTE, IMPERSONATE.

Published vs. Advertised

Advertised is a "soft-public" state — the entity can be found and viewed, but its binary content and supplementary attachments remain restricted.

What	Required Flag	Required State
Entity record (title, description)	`public = true`	published or advertised
Entity in list/search results	`publicList = true`	published or advertised
Binary content (file download)	`publicContent = true`	published only
Supplementary attachments	`publicSupplementary = true`	published only

In Queries: Filter, Don't Throw

Query fields silently filter unauthorized data to avoid leaking information:

kotlin

AuthenticationContext? is nullable in queries — unauthenticated requests are allowed but get filtered results.

In Mutations: Verify and Throw

kotlin

Creating New Entities

When creating, check permissions on the parent or require a group:

kotlin

GroupEvaluator

For operations that don't target a specific entity:

kotlin

Locked Entities

Some entities have a locked flag. Only the SA group can modify locked entities:

kotlin