[{"data":1,"prerenderedAt":494},["ShallowReactive",2],{"navigation_docs_en":3,"-en-reference-design-considerations-overly-permissive":309,"-en-reference-design-considerations-overly-permissive-surround":489},[4,30,72,112,195,299],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":6},"Getting Started",false,"\u002Fen\u002Fgetting-started","en\u002F1.getting-started",[10,15,20,25],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fen\u002Fgetting-started\u002Fintroduction","en\u002F1.getting-started\u002F2.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fen\u002Fgetting-started\u002Finstallation","en\u002F1.getting-started\u002F3.installation","i-lucide-download",{"title":21,"path":22,"stem":23,"icon":24},"Use Cases","\u002Fen\u002Fgetting-started\u002Fuse-cases","en\u002F1.getting-started\u002F4.use-cases","i-lucide-layers",{"title":26,"path":27,"stem":28,"icon":29},"Concepts","\u002Fen\u002Fgetting-started\u002Fconcepts","en\u002F1.getting-started\u002F5.concepts","i-lucide-book",{"title":26,"path":31,"stem":32,"children":33,"page":6},"\u002Fen\u002Fconcepts","en\u002F2.concepts",[34,38,43,48,53,58,63,68],{"title":35,"path":36,"stem":37,"icon":14},"Organization","\u002Fen\u002Fconcepts\u002Forganization","en\u002F2.concepts\u002F1.organization",{"title":39,"path":40,"stem":41,"icon":42},"Data Model","\u002Fen\u002Fconcepts\u002Fdata-model","en\u002F2.concepts\u002F2.data-model","i-lucide-database",{"title":44,"path":45,"stem":46,"icon":47},"Access Control","\u002Fen\u002Fconcepts\u002Faccess-permissions","en\u002F2.concepts\u002F3.access-permissions","i-lucide-user-key",{"title":49,"path":50,"stem":51,"icon":52},"Audit Logs","\u002Fen\u002Fconcepts\u002Faudit-logs","en\u002F2.concepts\u002F4.audit-logs","i-lucide-scroll-text",{"title":54,"path":55,"stem":56,"icon":57},"Introspection","\u002Fen\u002Fconcepts\u002Fintrospection","en\u002F2.concepts\u002F6.introspection","i-lucide-database-search",{"title":59,"path":60,"stem":61,"icon":62},"Query Engine","\u002Fen\u002Fconcepts\u002Fquery-engine","en\u002F2.concepts\u002F7.query-engine","i-lucide-workflow",{"title":64,"path":65,"stem":66,"icon":67},"AI","\u002Fen\u002Fconcepts\u002Fai","en\u002F2.concepts\u002F8.ai","i-lucide-sparkles",{"title":69,"path":70,"stem":71,"icon":42},"Caching","\u002Fen\u002Fconcepts\u002Fcaching","en\u002F2.concepts\u002F9.caching",{"title":73,"path":74,"stem":75,"children":76,"page":6},"Guides","\u002Fen\u002Fguides","en\u002F4.guides",[77,82,87,92,97,102,107],{"title":78,"path":79,"stem":80,"icon":81},"REST API Quickstart","\u002Fen\u002Fguides\u002Frest-api","en\u002F4.guides\u002F1.rest-api","i-lucide-plug",{"title":83,"path":84,"stem":85,"icon":86},"SDK Quickstart","\u002Fen\u002Fguides\u002Fsdk","en\u002F4.guides\u002F2.sdk","i-lucide-terminal",{"title":88,"path":89,"stem":90,"icon":91},"Configure SSO","\u002Fen\u002Fguides\u002Fconfigure-sso","en\u002F4.guides\u002F3.configure-sso","i-lucide-key-round",{"title":93,"path":94,"stem":95,"icon":96},"Configure MCP","\u002Fen\u002Fguides\u002Fmcp","en\u002F4.guides\u002F4.mcp","i-lucide-brain-cog",{"title":98,"path":99,"stem":100,"icon":101},"Customize Content Space","\u002Fen\u002Fguides\u002Fcustomize-content-space","en\u002F4.guides\u002F5.customize-content-space","i-lucide-columns-3-cog",{"title":103,"path":104,"stem":105,"icon":106},"Build an Application with AI Assistance","\u002Fen\u002Fguides\u002Fbuild-an-application","en\u002F4.guides\u002F6.build-an-application","i-lucide-route",{"title":108,"path":109,"stem":110,"icon":111},"Horizontal Scaling","\u002Fen\u002Fguides\u002Fhorizontal-scaling","en\u002F4.guides\u002F7.horizontal-scaling","i-lucide-network",{"title":113,"path":114,"stem":115,"children":116,"page":6},"Developer","\u002Fen\u002Fdeveloper","en\u002F5.developer",[117,171],{"title":118,"path":119,"stem":120,"children":121,"page":6},"Data Access","\u002Fen\u002Fdeveloper\u002Fapi","en\u002F5.developer\u002F1.api",[122,127,132,137,142,147,152,157,162,166],{"title":123,"path":124,"stem":125,"icon":126},"Overview","\u002Fen\u002Fdeveloper\u002Fapi\u002Foverview","en\u002F5.developer\u002F1.api\u002F1.overview","i-lucide-globe",{"title":128,"path":129,"stem":130,"icon":131},"Errors","\u002Fen\u002Fdeveloper\u002Fapi\u002Ferrors","en\u002F5.developer\u002F1.api\u002F10.errors","i-lucide-alert-triangle",{"title":133,"path":134,"stem":135,"icon":136},"Authentication","\u002Fen\u002Fdeveloper\u002Fapi\u002Fauthentication","en\u002F5.developer\u002F1.api\u002F2.authentication","i-lucide-lock",{"title":138,"path":139,"stem":140,"icon":141},"Reading Data","\u002Fen\u002Fdeveloper\u002Fapi\u002Freading-data","en\u002F5.developer\u002F1.api\u002F3.reading-data","i-lucide-book-open",{"title":143,"path":144,"stem":145,"icon":146},"Writing Data","\u002Fen\u002Fdeveloper\u002Fapi\u002Fwriting-data","en\u002F5.developer\u002F1.api\u002F4.writing-data","i-lucide-pencil",{"title":148,"path":149,"stem":150,"icon":151},"Filtering","\u002Fen\u002Fdeveloper\u002Fapi\u002Ffiltering","en\u002F5.developer\u002F1.api\u002F5.filtering","i-lucide-filter",{"title":153,"path":154,"stem":155,"icon":156},"Field Selection","\u002Fen\u002Fdeveloper\u002Fapi\u002Ffield-selection","en\u002F5.developer\u002F1.api\u002F6.field-selection","i-lucide-list-checks",{"title":158,"path":159,"stem":160,"icon":161},"Sorting & Pagination","\u002Fen\u002Fdeveloper\u002Fapi\u002Fsorting-pagination","en\u002F5.developer\u002F1.api\u002F7.sorting-pagination","i-lucide-arrow-up-down",{"title":163,"path":164,"stem":165,"icon":111},"Relational Data","\u002Fen\u002Fdeveloper\u002Fapi\u002Frelational-data","en\u002F5.developer\u002F1.api\u002F8.relational-data",{"title":167,"path":168,"stem":169,"icon":170},"Files & Assets","\u002Fen\u002Fdeveloper\u002Fapi\u002Ffiles","en\u002F5.developer\u002F1.api\u002F9.files","i-lucide-file-up",{"title":172,"path":173,"stem":174,"children":175,"page":6},"Client SDK","\u002Fen\u002Fdeveloper\u002Fsdk","en\u002F5.developer\u002F2.sdk",[176,180,185,190],{"title":177,"path":178,"stem":179,"icon":19},"Installation","\u002Fen\u002Fdeveloper\u002Fsdk\u002Finstallation","en\u002F5.developer\u002F2.sdk\u002F1.installation",{"title":181,"path":182,"stem":183,"icon":184},"Client Setup","\u002Fen\u002Fdeveloper\u002Fsdk\u002Fclient-setup","en\u002F5.developer\u002F2.sdk\u002F2.client-setup","i-lucide-settings",{"title":186,"path":187,"stem":188,"icon":189},"Type System","\u002Fen\u002Fdeveloper\u002Fsdk\u002Ftype-system","en\u002F5.developer\u002F2.sdk\u002F3.type-system","i-lucide-braces",{"title":191,"path":192,"stem":193,"icon":194},"Advanced","\u002Fen\u002Fdeveloper\u002Fsdk\u002Fadvanced","en\u002F5.developer\u002F2.sdk\u002F5.advanced","i-lucide-puzzle",{"title":196,"path":197,"stem":198,"children":199,"page":6},"Reference","\u002Fen\u002Freference","en\u002F6.reference",[200,204,209,225,229,234,270],{"title":201,"path":202,"stem":203,"icon":184},"Configuration","\u002Fen\u002Freference\u002Fenvironment-variables","en\u002F6.reference\u002F1.environment-variables",{"title":205,"path":206,"stem":207,"icon":208},"System Requirements","\u002Fen\u002Freference\u002Fsystem-requirements","en\u002F6.reference\u002F2.system-requirements","i-lucide-server",{"title":210,"path":211,"stem":212,"children":213,"icon":81},"Connectors","\u002Fen\u002Freference\u002Fconnectors","en\u002F6.reference\u002F3.connectors\u002Findex",[214,215,220],{"title":210,"path":211,"stem":212,"icon":81},{"title":216,"path":217,"stem":218,"icon":219},"PostgreSQL and Supabase","\u002Fen\u002Freference\u002Fconnectors\u002Fpostgresql-supabase","en\u002F6.reference\u002F3.connectors\u002F1.postgresql-supabase","i-simple-icons-postgresql",{"title":221,"path":222,"stem":223,"icon":224},"MySQL and MariaDB","\u002Fen\u002Freference\u002Fconnectors\u002Fmysql-mariadb","en\u002F6.reference\u002F3.connectors\u002F2.mysql-mariadb","i-simple-icons-mysql",{"title":226,"path":227,"stem":228,"icon":189},"Data Types Representation","\u002Fen\u002Freference\u002Fdata-types","en\u002F6.reference\u002F4.data-types",{"title":230,"path":231,"stem":232,"icon":233},"Permissions Reference","\u002Fen\u002Freference\u002Fpermissions","en\u002F6.reference\u002F5.permissions","i-lucide-shield",{"title":235,"path":236,"stem":237,"children":238,"page":6},"API Reference","\u002Fen\u002Freference\u002Fapi-reference","en\u002F6.reference\u002F6.api-reference",[239,243,248],{"title":240,"path":241,"stem":242,"icon":208},"System Endpoints","\u002Fen\u002Freference\u002Fapi-reference\u002Fsystem-endpoints","en\u002F6.reference\u002F6.api-reference\u002F1.system-endpoints",{"title":244,"path":245,"stem":246,"icon":247},"OpenAPI Spec","\u002Fen\u002Freference\u002Fapi-reference\u002Fopenapi-spec","en\u002F6.reference\u002F6.api-reference\u002F2.openapi-spec","i-lucide-file-code",{"title":249,"path":250,"stem":251,"children":252,"icon":254},"Schema Migration","\u002Fen\u002Freference\u002Fapi-reference\u002Fschema-migration","en\u002F6.reference\u002F6.api-reference\u002F3.schema-migration\u002Findex",[253,255,260,265],{"title":249,"path":250,"stem":251,"icon":254},"i-lucide-database-zap",{"title":256,"path":257,"stem":258,"icon":259},"Apply Migrations","\u002Fen\u002Freference\u002Fapi-reference\u002Fschema-migration\u002Fapply-migrations","en\u002F6.reference\u002F6.api-reference\u002F3.schema-migration\u002F1.apply-migrations","i-lucide-upload",{"title":261,"path":262,"stem":263,"icon":264},"Import Changes","\u002Fen\u002Freference\u002Fapi-reference\u002Fschema-migration\u002Fimport-changes","en\u002F6.reference\u002F6.api-reference\u002F3.schema-migration\u002F2.import-changes","i-lucide-refresh-cw",{"title":266,"path":267,"stem":268,"icon":269},"Operation Reference","\u002Fen\u002Freference\u002Fapi-reference\u002Fschema-migration\u002Foperation-reference","en\u002F6.reference\u002F6.api-reference\u002F3.schema-migration\u002F3.operation-reference","i-lucide-list-tree",{"title":271,"path":272,"stem":273,"children":274,"page":6},"Design Considerations","\u002Fen\u002Freference\u002Fdesign-considerations","en\u002F6.reference\u002F7.design-considerations",[275,279,284,289,294],{"title":123,"path":276,"stem":277,"icon":278},"\u002Fen\u002Freference\u002Fdesign-considerations\u002Foverview","en\u002F6.reference\u002F7.design-considerations\u002F1.overview","i-lucide-compass",{"title":280,"path":281,"stem":282,"icon":283},"Instance Configuration","\u002Fen\u002Freference\u002Fdesign-considerations\u002Finstance-configuration-related-problems","en\u002F6.reference\u002F7.design-considerations\u002F3.instance-configuration-related-problems","i-lucide-wrench",{"title":285,"path":286,"stem":287,"icon":288},"Overly Permissive Public Access","\u002Fen\u002Freference\u002Fdesign-considerations\u002Foverly-permissive","en\u002F6.reference\u002F7.design-considerations\u002F4.overly-permissive","i-lucide-shield-off",{"title":290,"path":291,"stem":292,"icon":293},"No Aggregates","\u002Fen\u002Freference\u002Fdesign-considerations\u002Fno-aggregates","en\u002F6.reference\u002F7.design-considerations\u002F5.no-aggregates","i-lucide-sigma",{"title":295,"path":296,"stem":297,"icon":298},"Cross-Data-Source Referential Integrity","\u002Fen\u002Freference\u002Fdesign-considerations\u002Fcross-data-source-referential-integrity","en\u002F6.reference\u002F7.design-considerations\u002F6.cross-data-source-referential-integrity","i-lucide-unlink",{"title":300,"icon":301,"path":302,"stem":303,"children":304,"page":6},"Release Notes","i-lucide-rocket","\u002Fen\u002Frelease-notes","en\u002F7.release-notes",[305],{"title":306,"path":307,"stem":308,"icon":301},"Changelog","\u002Fen\u002Frelease-notes\u002Fchangelog","en\u002F7.release-notes\u002F1.changelog",{"id":310,"title":285,"body":311,"description":482,"extension":483,"links":484,"meta":485,"navigation":486,"path":286,"seo":487,"stem":287,"__hash__":488},"docs_en\u002Fen\u002F6.reference\u002F7.design-considerations\u002F4.overly-permissive.md",{"type":312,"value":313,"toc":474},"minimark",[314,319,323,326,330,397,413,417,441,448,452],[315,316,318],"h2",{"id":317},"public-permissions","Public Permissions",[320,321,322],"p",{},"Each project's built-in Public role controls unauthenticated access through its attached policies. A new project's Public role has no policies and grants no collection access or workspace entitlements.",[320,324,325],{},"Granting access through a public policy makes that access available to anyone who can reach your API. Public access can include writes and administrative capabilities, depending on the policy.",[315,327,329],{"id":328},"excessive-grants","Excessive Grants",[331,332,333,345],"table",{},[334,335,336],"thead",{},[337,338,339,342],"tr",{},[340,341,201],"th",{},[340,343,344],{},"Risk",[346,347,348,357,365,373,381,389],"tbody",{},[337,349,350,354],{},[351,352,353],"td",{},"Admin policy",[351,355,356],{},"Grants unrestricted collection access and workspace entitlements",[337,358,359,362],{},[351,360,361],{},"Full read access",[351,363,364],{},"Exposes every item in the collection, including drafts or private content",[337,366,367,370],{},[351,368,369],{},"Wildcard field access",[351,371,372],{},"Exposes all fields, including fields added later",[337,374,375,378],{},[351,376,377],{},"Create, update, or delete grants",[351,379,380],{},"Allows unauthenticated callers to mutate data",[337,382,383,386],{},[351,384,385],{},"Administrative entitlements",[351,387,388],{},"Exposes the corresponding project administration capabilities",[337,390,391,394],{},[351,392,393],{},"Multiple policies",[351,395,396],{},"Adds all grants together; a restrictive policy cannot cancel a broader grant",[320,398,399,400,404,405,408,409,412],{},"A ",[401,402,403],"strong",{},"collection"," contains ",[401,406,407],{},"items",", and each item's named values are its ",[401,410,411],{},"fields",". Restrict public reads to the items and fields intended for publication.",[315,414,416],{"id":415},"limit-public-access","Limit Public Access",[418,419,420,424,427,430,438],"ul",{},[421,422,423],"li",{},"Attach Rules policies with explicit collection actions, item filters, and fields.",[421,425,426],{},"Leave write actions and administrative entitlements ungranted unless public callers need them.",[421,428,429],{},"Review every policy attached to Public, including policies shared with authenticated roles.",[421,431,432,433,437],{},"Test without an authorization header, an ",[434,435,436],"code",{},"access_token"," query parameter, or a session cookie.",[421,439,440],{},"Remove grants or detach policies to withdraw public access; keep the built-in role in place.",[320,442,443,444,447],{},"Unauthenticated requests cannot receive organization entitlements or resolve ",[434,445,446],{},"$CURRENT_USER",". These constraints do not limit collection access or workspace entitlements granted by public policies.",[315,449,451],{"id":450},"see-also","See Also",[418,453,454,462,468],{},[421,455,456,461],{},[457,458,460],"a",{"href":459},"\u002Fconcepts\u002Faccess-permissions#public-role","Public Role"," -- configure public access through policies",[421,463,464,467],{},[457,465,230],{"href":466},"\u002Freference\u002Fpermissions"," -- administrative capabilities and role constraints",[421,469,470,473],{},[457,471,133],{"href":472},"\u002Fdeveloper\u002Fapi\u002Fauthentication"," -- credential sources to omit when testing public requests",{"title":475,"searchDepth":476,"depth":476,"links":477},"",2,[478,479,480,481],{"id":317,"depth":476,"text":318},{"id":328,"depth":476,"text":329},{"id":415,"depth":476,"text":416},{"id":450,"depth":476,"text":451},"Limit the Public role's policies to the data and actions unauthenticated callers need.","md",null,{},{"icon":288},{"title":285,"description":482},"-oTqDfU_1jMOLY5Vjd7tkKe4_wpQtotVmR3k0ScJHgI",[490,492],{"title":280,"path":281,"stem":282,"description":491,"icon":283,"children":-1},"Understanding startup crashes due to malformed configs in Monospace.",{"title":290,"path":291,"stem":292,"description":493,"icon":293,"children":-1},"Understand the current limitations around data aggregation natively in the Monospace API.",1790103706137]