Policies

Policies define who is allowed to perform specific actions.
You can configure policies on three levels:

1. Context
2. Container (Thread, Store, Inbox, etc.)
3. Items inside Containers (such as messages or files)

This section focuses on policies in the scope of Containers.

Overview

• A policy set in a Container overwrites the policy inherited from the Context.

• A policy entry accepts one of the following values:

  • default — takes the default value (see the default values below)
  • inherit — inherits the value from the Context (only available in Container and item policies)
  • none — no user can perform this action
  • all — all Context users can perform this action
  • user — all Container users can perform this action
  • manager — all Container managers can perform this action
  • owner — only the Container owner can perform this action
  • itemOwner — only the item owner can perform this action (only available in item policies)

• If a Container or item policy is left empty, it defaults to inherit.

• If a Context policy is left empty, it defaults to default.

Combining Values

You can combine multiple values in one policy entry:

• Use & (AND) to require multiple conditions.
• Use , (OR) to allow multiple alternatives.

Operations with & are evaluated before ,.

Example

• Allow item updates only by the item owner, provided they are also a Container user:

itemOwner&user

• Allow updates by the item owner (if also a user) or by Container managers:

itemOwner&user,manager

Default Policy Values

PrivMX Endpoint can only define policies at the level of Containers and items. Context-level policies include rules related to creating Containers.
You must define those using PrivMX Bridge API.

Context

Thread

Thread Items

Store

Store Items

Inbox

Default vs Inherit

• default – applies system-defined default values (see tables above).
• inherit – inherits the setting from a higher level (for example, from Context if defining a Container or item policy).

Remember:

• An empty policy in a Container or item defaults to inherit.
• An empty policy in Context defaults to default.