Security and Workflow conditions

Security Statements decide permissions. Workflow uses that same permission language for Explicit activation and User Input admission, and an actor-independent profile for activation preconditions. These are separate settings: passing a business precondition does not grant permission.

Read the installed setting’s authoring description before writing an expression. Roots, role keys, responsibilities, targets and related facts depend on the selected Entity Definition or Board.

Profiles and roots

Profile	Available context
Entity Security	item for the record and admitted relationships; user for the actor.
Board Item Security	item, status, data, process, configured target selectors, and user, as described by the Board catalog.
Board Status Security	status and user; no Board Item or target context.
Workflow permission DSL	The Subject’s Entity or Board Item Security profile.
Workflow activation precondition	The Subject’s business context, without user, @currentUserId or security functions. Every Boolean operand must be Boolean; a number or text cannot stand in for a condition.

The user root exposes admitted actor properties such as Id, UserType, UserName, Email, FirstName, LastName, PhoneNumber and CreatedAt. It is absent from actor-independent conditions.

Field paths use exact case. Published Entity relationship paths can traverse up to five Reference hops, subject to the profile’s path and query-complexity limits. This does not extend the one-hop Entity Statement or field-behavior profiles. Board Security’s lower-case roots also differ from the BoardItem/BoardData/Target roots of Board Statements.

Operators, clock and collections

These profiles admit Boolean composition, compatible comparisons, IN, NOT IN, BETWEEN, text matching, null/empty tests, and the shared temporal operations. @today is the workspace-local date and @now the captured instant. Offsets include @today+7d and @now-30min; a date accepts whole days only. Actor-aware profiles also provide @currentUserId.

Numeric addition and subtraction are also admitted; multiplication and division belong to the calculated-field profile.

item.DueDate < @today
ADD_MONTHS(item.ContractStart, 1) <= @today
COUNT(item.Assemblies) > 0 AND ALL item.Assemblies WHERE (State = 'built')

These examples assume the named fields and collections exist in your catalog. Use EXISTS, ANY, ALL and COUNT over admitted child or inverse collections. Predicates read item-relative fields and can nest up to three levels. Configured related facts use exact binding keys, for example context.production.status.Key. See collections for empty sets, unknown results and invalid dependencies.

Only a valid TRUE passes. Comparisons with missing values propagate unknown through NOT, AND and OR; use explicit null checks to include them. Text equality is case-sensitive; text matching operators are case-insensitive. Do not copy the Entity-only CATEGORY, MATCHES or calculated-value functions into these profiles.

Security functions

HAS_ROLE('manager')
RESPONSIBLE(item, 'owner')
HAS_ROLE('manager') OR RESPONSIBLE(item, 'reviewer')

HAS_ROLE takes one nonempty literal role key. RESPONSIBLE takes an unquoted resource path and one nonempty literal responsibility key. The resource and responsibility must be offered together by the current catalog: for example, a Board Item and its current status are distinct resources. An admitted reference resource may also be used, such as RESPONSIBLE(item.Customer, 'reviewer').

Missing, disabled or stale definitions fail validation or the runtime decision; they never become a grant. Neither function is allowed inside a collection predicate or an actor-independent Workflow precondition. Write an actor test outside the collection condition when both are required.

Board target selectors

Select the exact configured target when reading target fields:

target(EntityDefinition, 'orders').DueDate < @today

The catalog may offer target(Itself), target(Entitlement) or target(Entitlement, 'model-key') as appropriate to the Board. Copy its offered selector rather than guessing the kind or model key. A selector needs a member; it is not a standalone value or a RESPONSIBLE resource argument.

target.Field is shorthand for the first configured target binding. Its meaning can change when target order changes; use an explicit selector when the binding must stay unambiguous. One expression may select only one target binding. Target selectors and security function calls are not available inside collection predicates; use the item-relative members published there.

Limits and runtime decisions

The current Security and business-condition profiles allow 8 KiB of UTF-8 source, 512 tokens, 128 nodes, depth 24, at most 64 list items and eight function arguments. Host admission additionally limits collection predicates to eight and relational joins to twelve. Consult ComplexityLimits and PredicateAdmission in the installed description for the current limits. Collections are never truncated to satisfy them.

Persisted permission and business-condition decisions execute in PostgreSQL with a captured clock and current dependencies. A catalog or schema error is not a false business fact. For permissions, failure grants nothing. Configuration metadata does not grant access to the records it describes.

See Entity access policies for permission composition and Workflow configuration for the separate activation, publication and runtime command lifecycle.