Returns the fixed permission map and the exact target Entity's rule catalogs.
using System.Net.Http.Headers;var client = new HttpClient();var request = new HttpRequestMessage{ Method = HttpMethod.Get, RequestUri = new Uri("https://example.com/api/workspace/admin/boards/boards/example/target-definitions/example/security-policy"), Headers = { { "Authorization", "Bearer <token>" }, },};using (var response = await client.SendAsync(request)){ response.EnsureSuccessStatusCode(); var body = await response.Content.ReadAsStringAsync(); Console.WriteLine(body);}const url = 'https://example.com/api/workspace/admin/boards/boards/example/target-definitions/example/security-policy';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://example.com/api/workspace/admin/boards/boards/example/target-definitions/example/security-policy \ --header 'Authorization: Bearer <token>'Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Query Parameters
Section titled “Query Parameters”Optional access token for clients that cannot set Authorization headers. Prefer Authorization: Bearer <token> when possible.
Responses
Section titled “Responses”OK
object
Common authoring catalogs for the exact saved target’s existing and initial-admission conditions.
object
The operation map is informational; conditions only narrow its mandatory Entity base.
object
Shared catalog and validation results for context permission authoring.
object
Read-only configuration metadata and expression diagnostics; never a runtime access decision.
object
A responsibility key and the exact resource path whose current assignment it denotes.
object
Describes one assignable permission.
object
Compiler diagnostics for one expression in the caller’s ordered batch.
object
Language metadata for an already authorized editing subject. Saving still compiles the exact submitted expression against the current subject and schema.
object
Offsets count UTF-16 code units in the submitted source, including CR/LF.
object
A named root with the scalar paths and collections admitted in this description.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
A collection and the scalar paths available inside its item scope.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
Canonical operator spelling and a template with named operand placeholders.
object
Operators and duration units applicable to one value family in this profile.
object
A captured context variable; Name includes its @ prefix.
object
MIN/MAX value and aggregate forms have distinct IDs. Null SQL support is unknown.
object
Ordered argument types and result type of a registered function overload.
object
CommonArguments finds one family from ResultArgumentIndex onward, ignores NULL and widens Integer/Decimal mixtures to Decimal. Argument retains the selected argument family; AverageArgument additionally widens Integer to Decimal. Fixed uses FixedResultFamily. RequireConcreteResult refuses an all-NULL result family. Function arity applies separately.
object
Form is Value, Collection, CollectionItem, SourceLiteral or BoundLiteral. Collection carries a collection path; CollectionItem binds in its item scope. SourceLiteral requires source literal syntax, whereas BoundLiteral permits a compile-time bound literal. A repeated final parameter covers remaining arguments. Numeric limits are inclusive; RegexPattern uses the shared supported regular-expression subset. These constraints do not replace compilation.
object
Compilation limits; source size counts UTF-8 bytes and positions count UTF-16 units.
object
Literal text with placeholders. Limits apply separately to placeholder contents, without braces; there is no template-wide size/placeholder count limit here. Value arguments are evaluated eagerly, including extra arguments and unused coalesce alternatives. Rendering uses invariant culture.
object
OperationId refers to Operations. Values accepts expressions of mixed families; Path requires one bare path from AllowedPathIds. PlaceholderTokenBudget has no separate arity limit: MaximumArguments is the largest simple call within the token budget. FirstArgumentToText uses the first value (missing becomes empty text); FirstNonEmptyArgument retains the first nonempty value, including zero/false. OptionLabelText resolves configured labels, falls back to keys and joins multiple labels with comma-space.
object
Host syntax lowered before normal function binding; empty for profiles without extensions.
Signatures describe source syntax, not value overloads. Choices are complete calls with correlated arguments; they must not be split into independent argument lists. Member selectors still need a declared member. Host forms may be unavailable within collection predicates.
object
One admitted source argument shape; catalog selection further constrains the complete call.
object
Identifier denotes source identifier syntax; StringLiteral never accepts a value expression.
object
A prefix such as target maps to this binding, including an inactive first target. BindingId is opaque. Selector is null when no unique explicit selector represents the binding; the prefix remains valid.
object
Admission after host lowering and binding. MaxCollectionPredicates counts bound EXISTS and COUNT nodes; MaxRelationalJoins includes host intrinsic joins. Boolean operands are required recursively when enabled. MaxSelectedTargets counts distinct target definitions per expression. Nested aggregate admission also follows the common compiler’s collection scope rules.
object
TargetBindingId identifies the edited field. TargetPathId links it to an admitted operand, or is null when its key cannot be used as a DSL path. AggregateMustBeRoot requires exactly one aggregate as the whole expression. Path reads an item field; PresenceCount permits SUM(collection, IF(path IS NULL, 0, 1)). AllowsNullResult describes the bound result family, not whether evaluation can produce a missing value.
object
BETWEEN accepts literals and paths under BetweenBoundPathRoots. Path-to-path binary comparisons require matching GroupId when enabled. NULL and membership constraints apply to operands, not missing runtime values. Owner node counting treats signed numbers and admitted local-day bounds as one operand; MaxBooleanDepth counts AND/OR/NOT, and MaxSourceNestingDepth bounds parentheses and consecutive NOT. These rules supplement the common grammar; field storage and operand compatibility still require compilation.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
MaxUsedMembers counts distinct first members under Name; RequiresValues concerns every path read under it.
object
NullComparisonForbiddenOperators reject NULL on either side; AllowsNullMembershipItems concerns list items only. These restrictions supplement individual path operators and full compilation.
object
Name includes @. For these operators, every counterpart of the variable must be one of these paths in its declared collection scope. Membership checks each left/item pair independently. Other membership items may have different forms admitted by the compiler.
object
When a listed operator uses this family, every operand must have the same family and group. Paths carry opaque group IDs. Other operands must be literals bound by a listed operation and resolved to that group by the server. NULL is not such a literal. Function arguments and catalog access still require server validation; group IDs expose no storage or catalog identifiers.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
An existing permission and its optional transition selector.
object
Shared catalog and validation results for context permission authoring.
object
Read-only configuration metadata and expression diagnostics; never a runtime access decision.
object
A responsibility key and the exact resource path whose current assignment it denotes.
object
Describes one assignable permission.
object
Compiler diagnostics for one expression in the caller’s ordered batch.
object
Language metadata for an already authorized editing subject. Saving still compiles the exact submitted expression against the current subject and schema.
object
Offsets count UTF-16 code units in the submitted source, including CR/LF.
object
A named root with the scalar paths and collections admitted in this description.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
A collection and the scalar paths available inside its item scope.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
Canonical operator spelling and a template with named operand placeholders.
object
Operators and duration units applicable to one value family in this profile.
object
A captured context variable; Name includes its @ prefix.
object
MIN/MAX value and aggregate forms have distinct IDs. Null SQL support is unknown.
object
Ordered argument types and result type of a registered function overload.
object
CommonArguments finds one family from ResultArgumentIndex onward, ignores NULL and widens Integer/Decimal mixtures to Decimal. Argument retains the selected argument family; AverageArgument additionally widens Integer to Decimal. Fixed uses FixedResultFamily. RequireConcreteResult refuses an all-NULL result family. Function arity applies separately.
object
Form is Value, Collection, CollectionItem, SourceLiteral or BoundLiteral. Collection carries a collection path; CollectionItem binds in its item scope. SourceLiteral requires source literal syntax, whereas BoundLiteral permits a compile-time bound literal. A repeated final parameter covers remaining arguments. Numeric limits are inclusive; RegexPattern uses the shared supported regular-expression subset. These constraints do not replace compilation.
object
Compilation limits; source size counts UTF-8 bytes and positions count UTF-16 units.
object
Literal text with placeholders. Limits apply separately to placeholder contents, without braces; there is no template-wide size/placeholder count limit here. Value arguments are evaluated eagerly, including extra arguments and unused coalesce alternatives. Rendering uses invariant culture.
object
OperationId refers to Operations. Values accepts expressions of mixed families; Path requires one bare path from AllowedPathIds. PlaceholderTokenBudget has no separate arity limit: MaximumArguments is the largest simple call within the token budget. FirstArgumentToText uses the first value (missing becomes empty text); FirstNonEmptyArgument retains the first nonempty value, including zero/false. OptionLabelText resolves configured labels, falls back to keys and joins multiple labels with comma-space.
object
Host syntax lowered before normal function binding; empty for profiles without extensions.
Signatures describe source syntax, not value overloads. Choices are complete calls with correlated arguments; they must not be split into independent argument lists. Member selectors still need a declared member. Host forms may be unavailable within collection predicates.
object
One admitted source argument shape; catalog selection further constrains the complete call.
object
Identifier denotes source identifier syntax; StringLiteral never accepts a value expression.
object
A prefix such as target maps to this binding, including an inactive first target. BindingId is opaque. Selector is null when no unique explicit selector represents the binding; the prefix remains valid.
object
Admission after host lowering and binding. MaxCollectionPredicates counts bound EXISTS and COUNT nodes; MaxRelationalJoins includes host intrinsic joins. Boolean operands are required recursively when enabled. MaxSelectedTargets counts distinct target definitions per expression. Nested aggregate admission also follows the common compiler’s collection scope rules.
object
TargetBindingId identifies the edited field. TargetPathId links it to an admitted operand, or is null when its key cannot be used as a DSL path. AggregateMustBeRoot requires exactly one aggregate as the whole expression. Path reads an item field; PresenceCount permits SUM(collection, IF(path IS NULL, 0, 1)). AllowsNullResult describes the bound result family, not whether evaluation can produce a missing value.
object
BETWEEN accepts literals and paths under BetweenBoundPathRoots. Path-to-path binary comparisons require matching GroupId when enabled. NULL and membership constraints apply to operands, not missing runtime values. Owner node counting treats signed numbers and admitted local-day bounds as one operand; MaxBooleanDepth counts AND/OR/NOT, and MaxSourceNestingDepth bounds parentheses and consecutive NOT. These rules supplement the common grammar; field storage and operand compatibility still require compilation.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
MaxUsedMembers counts distinct first members under Name; RequiresValues concerns every path read under it.
object
NullComparisonForbiddenOperators reject NULL on either side; AllowsNullMembershipItems concerns list items only. These restrictions supplement individual path operators and full compilation.
object
Name includes @. For these operators, every counterpart of the variable must be one of these paths in its declared collection scope. Membership checks each left/item pair independently. Other membership items may have different forms admitted by the compiler.
object
When a listed operator uses this family, every operand must have the same family and group. Paths carry opaque group IDs. Other operands must be literals bound by a listed operation and resolved to that group by the server. NULL is not such a literal. Function arguments and catalog access still require server validation; group IDs expose no storage or catalog identifiers.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
An existing permission and its optional transition selector.
object
Current source label from the same authorized configuration read.
Saved enabled grants whose explicit conditions remain authoritative outside the inherited map.
A saved explicit permission grant outside the inherited operation map and its canonical access policies.
object
Describes one assignable permission.
object
Describes one Access Policy projected from a Statement and its Permission Assignments.
object
Describes a guided condition projection that can round-trip to the canonical Statement DSL.
object
Describes one guided condition while retaining its exact DSL expression.
object
The configuration object that owns a generated Security artifact.
object
Owner resource kind.
Stable owner identity.
Current owner display name or key.
The permission is Board-wide and independent of the target’s Entity policy.
Whether the current canonical explicit grants were read successfully; unknown is never an empty safe grant set.
Current authoring and saved-reference diagnostics; invalid references remain part of the saved target.
object
object
The saved conditions container cannot be decoded; an ordinary mode change must not replace it.
Whether the authoritative selector finds an authored View restriction for this target, including disabled bindings and excluding transition-owned additive grants.
Actual saved policies selected by the same authored View binding selector, including disabled restrictions.
Describes one Access Policy projected from a Statement and its Permission Assignments.
object
Describes a guided condition projection that can round-trip to the canonical Statement DSL.
object
Describes one guided condition while retaining its exact DSL expression.
object
The configuration object that owns a generated Security artifact.
object
Owner resource kind.
Stable owner identity.
Current owner display name or key.
Independent module gates required in addition to Entity and native operation permissions.
object
object
object
object
Example
{ "Data": { "Diagnostics": [ { "Type": 0, "Severity": 0 } ] }, "Errors": [ { "Type": 0, "Severity": 0 } ], "Warnings": [ { "Type": 0, "Severity": 0 } ]}Unauthorized
object
Examplegenerated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "instance": "example"}Forbidden
object
Examplegenerated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "instance": "example"}Not Found
object
Common authoring catalogs for the exact saved target’s existing and initial-admission conditions.
object
The operation map is informational; conditions only narrow its mandatory Entity base.
object
Shared catalog and validation results for context permission authoring.
object
Read-only configuration metadata and expression diagnostics; never a runtime access decision.
object
A responsibility key and the exact resource path whose current assignment it denotes.
object
Describes one assignable permission.
object
Compiler diagnostics for one expression in the caller’s ordered batch.
object
Language metadata for an already authorized editing subject. Saving still compiles the exact submitted expression against the current subject and schema.
object
Offsets count UTF-16 code units in the submitted source, including CR/LF.
object
A named root with the scalar paths and collections admitted in this description.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
A collection and the scalar paths available inside its item scope.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
Canonical operator spelling and a template with named operand placeholders.
object
Operators and duration units applicable to one value family in this profile.
object
A captured context variable; Name includes its @ prefix.
object
MIN/MAX value and aggregate forms have distinct IDs. Null SQL support is unknown.
object
Ordered argument types and result type of a registered function overload.
object
CommonArguments finds one family from ResultArgumentIndex onward, ignores NULL and widens Integer/Decimal mixtures to Decimal. Argument retains the selected argument family; AverageArgument additionally widens Integer to Decimal. Fixed uses FixedResultFamily. RequireConcreteResult refuses an all-NULL result family. Function arity applies separately.
object
Form is Value, Collection, CollectionItem, SourceLiteral or BoundLiteral. Collection carries a collection path; CollectionItem binds in its item scope. SourceLiteral requires source literal syntax, whereas BoundLiteral permits a compile-time bound literal. A repeated final parameter covers remaining arguments. Numeric limits are inclusive; RegexPattern uses the shared supported regular-expression subset. These constraints do not replace compilation.
object
Compilation limits; source size counts UTF-8 bytes and positions count UTF-16 units.
object
Literal text with placeholders. Limits apply separately to placeholder contents, without braces; there is no template-wide size/placeholder count limit here. Value arguments are evaluated eagerly, including extra arguments and unused coalesce alternatives. Rendering uses invariant culture.
object
OperationId refers to Operations. Values accepts expressions of mixed families; Path requires one bare path from AllowedPathIds. PlaceholderTokenBudget has no separate arity limit: MaximumArguments is the largest simple call within the token budget. FirstArgumentToText uses the first value (missing becomes empty text); FirstNonEmptyArgument retains the first nonempty value, including zero/false. OptionLabelText resolves configured labels, falls back to keys and joins multiple labels with comma-space.
object
Host syntax lowered before normal function binding; empty for profiles without extensions.
Signatures describe source syntax, not value overloads. Choices are complete calls with correlated arguments; they must not be split into independent argument lists. Member selectors still need a declared member. Host forms may be unavailable within collection predicates.
object
One admitted source argument shape; catalog selection further constrains the complete call.
object
Identifier denotes source identifier syntax; StringLiteral never accepts a value expression.
object
A prefix such as target maps to this binding, including an inactive first target. BindingId is opaque. Selector is null when no unique explicit selector represents the binding; the prefix remains valid.
object
Admission after host lowering and binding. MaxCollectionPredicates counts bound EXISTS and COUNT nodes; MaxRelationalJoins includes host intrinsic joins. Boolean operands are required recursively when enabled. MaxSelectedTargets counts distinct target definitions per expression. Nested aggregate admission also follows the common compiler’s collection scope rules.
object
TargetBindingId identifies the edited field. TargetPathId links it to an admitted operand, or is null when its key cannot be used as a DSL path. AggregateMustBeRoot requires exactly one aggregate as the whole expression. Path reads an item field; PresenceCount permits SUM(collection, IF(path IS NULL, 0, 1)). AllowsNullResult describes the bound result family, not whether evaluation can produce a missing value.
object
BETWEEN accepts literals and paths under BetweenBoundPathRoots. Path-to-path binary comparisons require matching GroupId when enabled. NULL and membership constraints apply to operands, not missing runtime values. Owner node counting treats signed numbers and admitted local-day bounds as one operand; MaxBooleanDepth counts AND/OR/NOT, and MaxSourceNestingDepth bounds parentheses and consecutive NOT. These rules supplement the common grammar; field storage and operand compatibility still require compilation.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
MaxUsedMembers counts distinct first members under Name; RequiresValues concerns every path read under it.
object
NullComparisonForbiddenOperators reject NULL on either side; AllowsNullMembershipItems concerns list items only. These restrictions supplement individual path operators and full compilation.
object
Name includes @. For these operators, every counterpart of the variable must be one of these paths in its declared collection scope. Membership checks each left/item pair independently. Other membership items may have different forms admitted by the compiler.
object
When a listed operator uses this family, every operand must have the same family and group. Paths carry opaque group IDs. Other operands must be literals bound by a listed operation and resolved to that group by the server. NULL is not such a literal. Function arguments and catalog access still require server validation; group IDs expose no storage or catalog identifiers.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
An existing permission and its optional transition selector.
object
Shared catalog and validation results for context permission authoring.
object
Read-only configuration metadata and expression diagnostics; never a runtime access decision.
object
A responsibility key and the exact resource path whose current assignment it denotes.
object
Describes one assignable permission.
object
Compiler diagnostics for one expression in the caller’s ordered batch.
object
Language metadata for an already authorized editing subject. Saving still compiles the exact submitted expression against the current subject and schema.
object
Offsets count UTF-16 code units in the submitted source, including CR/LF.
object
A named root with the scalar paths and collections admitted in this description.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
A collection and the scalar paths available inside its item scope.
object
Id is opaque and stable within this collection scope until its binding changes.
object
Operators admitted for this path in its collection scope, after owner restrictions.
Canonical operator spelling and a template with named operand placeholders.
object
Operators and duration units applicable to one value family in this profile.
object
A captured context variable; Name includes its @ prefix.
object
MIN/MAX value and aggregate forms have distinct IDs. Null SQL support is unknown.
object
Ordered argument types and result type of a registered function overload.
object
CommonArguments finds one family from ResultArgumentIndex onward, ignores NULL and widens Integer/Decimal mixtures to Decimal. Argument retains the selected argument family; AverageArgument additionally widens Integer to Decimal. Fixed uses FixedResultFamily. RequireConcreteResult refuses an all-NULL result family. Function arity applies separately.
object
Form is Value, Collection, CollectionItem, SourceLiteral or BoundLiteral. Collection carries a collection path; CollectionItem binds in its item scope. SourceLiteral requires source literal syntax, whereas BoundLiteral permits a compile-time bound literal. A repeated final parameter covers remaining arguments. Numeric limits are inclusive; RegexPattern uses the shared supported regular-expression subset. These constraints do not replace compilation.
object
Compilation limits; source size counts UTF-8 bytes and positions count UTF-16 units.
object
Literal text with placeholders. Limits apply separately to placeholder contents, without braces; there is no template-wide size/placeholder count limit here. Value arguments are evaluated eagerly, including extra arguments and unused coalesce alternatives. Rendering uses invariant culture.
object
OperationId refers to Operations. Values accepts expressions of mixed families; Path requires one bare path from AllowedPathIds. PlaceholderTokenBudget has no separate arity limit: MaximumArguments is the largest simple call within the token budget. FirstArgumentToText uses the first value (missing becomes empty text); FirstNonEmptyArgument retains the first nonempty value, including zero/false. OptionLabelText resolves configured labels, falls back to keys and joins multiple labels with comma-space.
object
Host syntax lowered before normal function binding; empty for profiles without extensions.
Signatures describe source syntax, not value overloads. Choices are complete calls with correlated arguments; they must not be split into independent argument lists. Member selectors still need a declared member. Host forms may be unavailable within collection predicates.
object
One admitted source argument shape; catalog selection further constrains the complete call.
object
Identifier denotes source identifier syntax; StringLiteral never accepts a value expression.
object
A prefix such as target maps to this binding, including an inactive first target. BindingId is opaque. Selector is null when no unique explicit selector represents the binding; the prefix remains valid.
object
Admission after host lowering and binding. MaxCollectionPredicates counts bound EXISTS and COUNT nodes; MaxRelationalJoins includes host intrinsic joins. Boolean operands are required recursively when enabled. MaxSelectedTargets counts distinct target definitions per expression. Nested aggregate admission also follows the common compiler’s collection scope rules.
object
TargetBindingId identifies the edited field. TargetPathId links it to an admitted operand, or is null when its key cannot be used as a DSL path. AggregateMustBeRoot requires exactly one aggregate as the whole expression. Path reads an item field; PresenceCount permits SUM(collection, IF(path IS NULL, 0, 1)). AllowsNullResult describes the bound result family, not whether evaluation can produce a missing value.
object
BETWEEN accepts literals and paths under BetweenBoundPathRoots. Path-to-path binary comparisons require matching GroupId when enabled. NULL and membership constraints apply to operands, not missing runtime values. Owner node counting treats signed numbers and admitted local-day bounds as one operand; MaxBooleanDepth counts AND/OR/NOT, and MaxSourceNestingDepth bounds parentheses and consecutive NOT. These rules supplement the common grammar; field storage and operand compatibility still require compilation.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
MaxUsedMembers counts distinct first members under Name; RequiresValues concerns every path read under it.
object
NullComparisonForbiddenOperators reject NULL on either side; AllowsNullMembershipItems concerns list items only. These restrictions supplement individual path operators and full compilation.
object
Name includes @. For these operators, every counterpart of the variable must be one of these paths in its declared collection scope. Membership checks each left/item pair independently. Other membership items may have different forms admitted by the compiler.
object
When a listed operator uses this family, every operand must have the same family and group. Paths carry opaque group IDs. Other operands must be literals bound by a listed operation and resolved to that group by the server. NULL is not such a literal. Function arguments and catalog access still require server validation; group IDs expose no storage or catalog identifiers.
object
Opaque path identity and comparison group; groups reveal no storage or source-definition identifiers.
object
An existing permission and its optional transition selector.
object
Current source label from the same authorized configuration read.
Saved enabled grants whose explicit conditions remain authoritative outside the inherited map.
A saved explicit permission grant outside the inherited operation map and its canonical access policies.
object
Describes one assignable permission.
object
Describes one Access Policy projected from a Statement and its Permission Assignments.
object
Describes a guided condition projection that can round-trip to the canonical Statement DSL.
object
Describes one guided condition while retaining its exact DSL expression.
object
The configuration object that owns a generated Security artifact.
object
Owner resource kind.
Stable owner identity.
Current owner display name or key.
The permission is Board-wide and independent of the target’s Entity policy.
Whether the current canonical explicit grants were read successfully; unknown is never an empty safe grant set.
Current authoring and saved-reference diagnostics; invalid references remain part of the saved target.
object
object
The saved conditions container cannot be decoded; an ordinary mode change must not replace it.
Whether the authoritative selector finds an authored View restriction for this target, including disabled bindings and excluding transition-owned additive grants.
Actual saved policies selected by the same authored View binding selector, including disabled restrictions.
Describes one Access Policy projected from a Statement and its Permission Assignments.
object
Describes a guided condition projection that can round-trip to the canonical Statement DSL.
object
Describes one guided condition while retaining its exact DSL expression.
object
The configuration object that owns a generated Security artifact.
object
Owner resource kind.
Stable owner identity.
Current owner display name or key.
Independent module gates required in addition to Entity and native operation permissions.
object
object
object
object
Example
{ "Data": { "Diagnostics": [ { "Type": 0, "Severity": 0 } ] }, "Errors": [ { "Type": 0, "Severity": 0 } ], "Warnings": [ { "Type": 0, "Severity": 0 } ]}