---
title: Permission
description: Permission protocol schemas
---

{/* ⚠️  AUTO-GENERATED — DO NOT EDIT. Run build-docs.ts to regenerate. Hand-written docs go in content/docs/guides/. */}

Entity (Object) Level Permissions

Defines CRUD + VAMA (View All / Modify All) + Lifecycle access.

Refined with enterprise data lifecycle controls:

- Transfer (Ownership change)

- Restore (Soft delete recovery)

- Purge (Hard delete / Compliance)

<Callout type="info">
**Source:** `packages/spec/src/security/permission.zod.ts`
</Callout>

## TypeScript Usage

```typescript
import { FieldPermission, ObjectPermission, PermissionSet } from '@objectstack/spec/security';
import type { FieldPermission, ObjectPermission, PermissionSet } from '@objectstack/spec/security';

// Validate data
const result = FieldPermission.parse(data);
```

---

## FieldPermission

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **readable** | `boolean` | ✅ | Field read access |
| **editable** | `boolean` | ✅ | Field edit access |


---

## ObjectPermission

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **allowCreate** | `boolean` | ✅ | Create permission |
| **allowRead** | `boolean` | ✅ | Read permission |
| **allowEdit** | `boolean` | ✅ | Edit permission |
| **allowDelete** | `boolean` | ✅ | Delete permission |
| **allowTransfer** | `boolean` | ✅ | Change record ownership |
| **allowRestore** | `boolean` | ✅ | Restore from trash (Undelete) |
| **allowPurge** | `boolean` | ✅ | Permanently delete (Hard Delete/GDPR) |
| **viewAllRecords** | `boolean` | ✅ | View All Data (Bypass Sharing) |
| **modifyAllRecords** | `boolean` | ✅ | Modify All Data (Bypass Sharing) |


---

## PermissionSet

### Properties

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **name** | `string` | ✅ | Permission set unique name (lowercase snake_case) |
| **label** | `string` | optional | Display label |
| **isProfile** | `boolean` | ✅ | Whether this is a user profile |
| **objects** | `Record<string, Object>` | ✅ | Entity permissions |
| **fields** | `Record<string, Object>` | optional | Field level security |
| **systemPermissions** | `string[]` | optional | System level capabilities |
| **tabPermissions** | `Record<string, Enum<'visible' \| 'hidden' \| 'default_on' \| 'default_off'>>` | optional | App/tab visibility: visible, hidden, default_on (shown by default), default_off (available but hidden initially) |
| **rowLevelSecurity** | `Object[]` | optional | Row-level security policies (see rls.zod.ts for full spec) |
| **contextVariables** | `Record<string, any>` | optional | Context variables for RLS evaluation |


---

