---
title: services.sharing
description: Record-level sharing and editability checks.
---

# `services.sharing`

- **Stability:** `stable`
- **Canonical source:** `packages/spec/src/contracts/sharing-service.ts`

## Methods

```ts
services.sharing.buildReadFilter(object: string, context: SharingExecutionContext): Promise<unknown | null>
services.sharing.canEdit(object: string, recordId: string, context: SharingExecutionContext): Promise<boolean>
services.sharing.grant(input: GrantShareInput, context: SharingExecutionContext): Promise<RecordShare>
services.sharing.revoke(shareId: string, context: SharingExecutionContext): Promise<void>
services.sharing.listShares(object: string, recordId: string, context: SharingExecutionContext): Promise<RecordShare[]>
```

## Returns

- `buildReadFilter`: `null` means unrestricted read; otherwise returns an engine filter
- `canEdit`: boolean decision
- `grant`/`listShares`: normalized `RecordShare` rows

## Typical Errors

- `PERMISSION_DENIED`
- `SHARE_NOT_FOUND` (implementation-defined)

## Example

```ts
const allowed = await services.sharing.canEdit('contract', ctx.input.id, {
  userId: ctx.session?.userId,
  tenantId: ctx.session?.tenantId,
  roles: ctx.session?.roles,
});
if (!allowed) throw new Error('PERMISSION_DENIED');
```
