Skip to content
MoltaroMoltaroMoltaro Docs

Entity Security

An Entity Definition is governed by Security Statements assigned to Permissions. A Security Statement can evaluate the current user, stable role keys, responsibilities, record data, references, and a captured workspace clock. There are no Entity access modes and no inherited-access maintenance jobs.

Root and action permissions

Section titled “Root and action permissions”

View is the root permission. If no valid enabled Security Statement is assigned to View, Moltaro blocks access to Entity records. Every record action requires View plus its exact permission, for example:

  • update: View + Update;
  • archive or delete: View + the exact lifecycle action;
  • restore: View + ReadArchive + Restore;
  • comments, attachments, and tags: View + the exact ancillary action.

Create also checks each supplied Field:CreateWrite, applies configured initial responsibilities, and verifies final View. If final View is denied, the complete create transaction rolls back and does not reveal the attempted ID.

Responsibilities

Section titled “Responsibilities”

Responsibility Definitions are stable, named business responsibilities such as Owner, Assignee, or Reviewer. They define the allowed subject type, whether one or many subjects can be assigned, whether assignment is required, whether future scheduling is allowed, eligible Responsibility Groups, and whether the responsibility is enabled. Assignment Rules separately authorize Add, Replace, and Close; Update does not grant assignment authority.

Assignments use users or Responsibility Groups and are stored as immutable, auditable change sets. Their history remains available after a definition is disabled when the caller has View + Responsibilities:History.

Field access

Section titled “Field access”

Field:Read, Field:CreateWrite, and Field:Write are independent permissions. A denied field is absent from record JSON, nested rows, table metadata, display values, and reference previews. Search requires Field:Read; conditionally readable fields cannot be used for sort, filter, grouping, or aggregation unless access is proven unconditional for the captured actor and clock.

When no field-specific assignment exists, the field inherits its root permission: read inherits View, create-write inherits Create, and write inherits View or Update. Explicit field assignments are global allow-lists for that exact field, not local denies.

Query isolation

Section titled “Query isolation”

Moltaro applies the Security Statement SQL predicate before user filters, count, and pagination. Direct reads and list reads use the same authorization snapshot, so hidden rows do not create page gaps or disclose their positions.

Owner and Admin have no implicit access to Entity records. Administration access never substitutes for View or field permissions.

When Moltaro creates a new standalone Entity Definition, it also creates an ordinary Admin access policy. The policy grants the built-in Admin role all record-level permissions available at that moment; fields inherit the matching record permissions. This saves the initial setup step but does not create a hidden Admin bypass. You can edit or delete the policy, and Moltaro will not restore it during system or package reconciliation. Existing Entity Definitions are not changed automatically, and an imported Entity Definition keeps its explicit Security configuration, including an intentionally empty one.

Manage Entity Security in the WebApp

Section titled “Manage Entity Security in the WebApp”

Open the Entity Definition and use the three entries under Security:

  • Responsibilities configures responsible subjects and assignment rules;
  • Access Policies creates or edits a condition together with its exact record, lifecycle, transfer, collaboration, history, and responsibility Permissions. Review the server Plan before applying the policy atomically;
  • Permissions manages explicit field refinements and displays inherited fields. It also provides the manual normalization Plan for refinements whose Statement-key sets exactly match their root permission.

Security Statements remain separate from calculated Entity Statements. Saved policy changes preserve the canonical Statement and Permission Assignment runtime model. Raw configuration — Advanced keeps the immediately effective expert endpoints available and invalidates any outstanding Plan.

Where to go next

Section titled “Where to go next”