Design Considerations
Overly Permissive Public Access
Limit the Public role's policies to the data and actions unauthenticated callers need.
Public Permissions
Each project's built-in Public role controls unauthenticated access through its attached policies. A new project's Public role has no policies and grants no collection access or workspace entitlements.
Granting access through a public policy makes that access available to anyone who can reach your API. Public access can include writes and administrative capabilities, depending on the policy.
Excessive Grants
| Configuration | Risk |
|---|---|
| Admin policy | Grants unrestricted collection access and workspace entitlements |
| Full read access | Exposes every item in the collection, including drafts or private content |
| Wildcard field access | Exposes all fields, including fields added later |
| Create, update, or delete grants | Allows unauthenticated callers to mutate data |
| Administrative entitlements | Exposes the corresponding project administration capabilities |
| Multiple policies | Adds all grants together; a restrictive policy cannot cancel a broader grant |
A collection contains items, and each item's named values are its fields. Restrict public reads to the items and fields intended for publication.
Limit Public Access
- Attach Rules policies with explicit collection actions, item filters, and fields.
- Leave write actions and administrative entitlements ungranted unless public callers need them.
- Review every policy attached to Public, including policies shared with authenticated roles.
- Test without an authorization header, an
access_tokenquery parameter, or a session cookie. - Remove grants or detach policies to withdraw public access; keep the built-in role in place.
Unauthenticated requests cannot receive organization entitlements or resolve $CURRENT_USER. These constraints do not limit collection access or workspace entitlements granted by public policies.
See Also
- Public Role -- configure public access through policies
- Permissions Reference -- administrative capabilities and role constraints
- Authentication -- credential sources to omit when testing public requests