Reference

Permissions Reference

The full catalog of Monospace entitlements, the entitlement string format, and the built-in Public role.

Overview

Entitlements grant administrative capabilities through policies attached to roles. Read Access Control for collection permissions and public access configuration.

Entitlement String Format

An entitlement is evaluated as a granular string that denotes an exact capability or access scope. It is formatted as:

resource:action[:id]

For example:

dataModel:edit — edit the data model.
role:read:* — read any role.
role:assign:509139cf-... — assign one specific role.

Wildcards

Entitlements support the * wildcard at the action and id levels:

dataModel:* grants every data model action.
role:read:* grants read access to all roles.

When an action is granted with a specific id, it filters the relevant endpoints so the user can act only on that item.

Note

Entitlements are independent: none is a prerequisite for another, and they are separate from collection permissions. An entitlement governs an administrative capability — it never controls the data inside your collections. For example, dataSource:read lets a user view a data source's connection configuration; it does not affect whether they can read data in that source's collections, which is controlled entirely by collection permissions.

Filter Variables

Item filters, field filters, and validation rules accept the $CURRENT_USER variable in place of a literal value. Monospace substitutes the requesting user's data when it evaluates the rule. See Dynamic Filters for how to apply it.

Syntax	Resolves to	Type
`$CURRENT_USER`	The requesting user's ID	UUID
`$CURRENT_USER.{field}`	A field on the user's record	The field's type
`$CURRENT_USER.{relation}.{field}`	A field on an item linked to the user	The field's type

Rules for the variable:

Each segment names a field on the record reached so far, and the path ends on a field.
Every segment before the last names a to-one relation. To-many relations are not traversable, and a trailing dot is rejected.
A name that is not a field on the record it addresses is rejected when you save the policy, as is a type that does not match the field being compared.
Monospace resolves the value against the user's record on each request.

A relation is to-one from the user's side only when each member can be referenced by at most one item. Create one with a User field set to Single User with Exclusive enabled, which adds the unique constraint that makes the relation one-to-one.

Caution

A to-one relation from the user's record is always nullable. When no linked item exists the path resolves to null, and a comparison against a non-nullable field fails the request rather than matching nothing.

An unauthenticated request cannot resolve $CURRENT_USER, and neither can internal system execution. A rule that depends on the variable therefore grants nothing to the Public role.

Workspace Entitlements

Workspace entitlements are evaluated within a single workspace, and are granted through the policies attached to a member's roles.

Resource	Actions	Controls
`dataModel`	`read`, `edit`	View the schema (`read`); create and change collections, fields, and indexes via migrations (`edit`).
`workspaceMembers`	`read`, `readInvites`, `add`, `delete`	List workspace members (`read`) and pending invites (`readInvites`); invite (`add`) and remove (`delete`) members.
`workspaceSettings`	`read`, `edit`	View and change workspace settings.
`dataSource`	`create`, `read:{id}`, `delete:{id}`	Connect, view, and disconnect data sources. `create` also locks and unlocks a source's schema. `read` views a source's connection configuration — not the data in its collections.
`role`	`create`, `read:{id}`, `assign:{id}`, `update:{id}`, `delete:{id}`	Create, view, assign, modify, and delete roles.
`policy`	`create`, `read:{id}`, `assign:{id}`, `update:{id}`, `delete:{id}`	Create, view, attach, modify, and delete policies.
`ai`	`access`, `admin`, `mcp`	Use AI chat (`access`); configure AI settings and providers (`admin`); connect to the MCP server (`mcp`).
`openApiSchema`	`read`	Read the workspace's OpenAPI specification.
`space`	`read:{id}`	View a content space and its pages.
`keyStorage`	`accessOwn`, `accessShared`	Read and write the member's own (`accessOwn`) or shared (`accessShared`) key-value entries.
`extension`	`read`	List the instance's installed extensions and the data connectors they provide, through `GET /api/{workspace}/extensions` and `GET /api/{workspace}/connectors/data`. Built-in connectors are not listed. The built-in Studio Access policy in each workspace includes it.

Organization Entitlements

Organization entitlements are evaluated across the organization, at the /api/system/ scope.

Note

Organization entitlements are conferred by organization-administrator status — an admin holds all of them, and no one else holds any. They do not appear in the policy editor and cannot be granted individually, because a policy carries workspace entitlements only. They are listed here because they decide which /api/system/ operations succeed.

Resource	Actions	Controls
`workspace`	`create`, `update:{id}`, `delete:{id}`	Create, update, and delete workspaces.
`orgRole`	`assign:{id}`	Assign organization roles to members.
`apiKey`	`create`, `read`, `update:{id}`, `delete:{id}`	Create, list, update, and delete API keys.
`serviceAccount`	`create`, `read`, `update:{id}`, `delete:{id}`	Create, list, update, and delete service accounts.
`orgMembers`	`read`, `readInvites`, `add`, `delete`	List organization members (`read`) and pending organization invitations (`readInvites`); add and remove members.
`user`	`update:{id}`	Update a member's organization-level profile, and suspend or reactivate their account.
`orgSettings`	`edit`	Change organization settings.
`authProvider`	`create`, `read`, `update`, `delete`	Create, view, update, and delete SSO providers.
`auditLog`	`read`	Read the organization audit log.
`orgLicense`	`read`, `manage`	See license management details on `GET /api/system/license` (`read`); revalidate the license with `POST /api/system/license/refresh` (`manage`).
`file`	`delete:{id}`	Delete a specific system file — a member avatar, the organization logo, or a workspace logo.
`systemOpenApiSchema`	`read`	Read the system OpenAPI specification.
`extension`	`read`	List the instance's installed extensions through `GET /api/system/extensions`.

Public Role

Each project has one built-in Public role with ID 00000000-0000-0000-0000-000000000001. Its attached policies determine collection permissions and workspace entitlements for unauthenticated requests.

Behavior	Rule
Provisioning	Created automatically with no policies attached
Public identity	Determined by the fixed role ID; roles have no `isPublic` setting
Configuration	Attach or detach policies to control access
Role management API	Rejects updates and deletion of the Public role
User assignment	The Public role cannot be assigned to a user
Authenticated requests	Use the user's assigned roles without automatically adding public permissions
Organization entitlements	Unavailable to unauthenticated requests

Follow Public Role to configure and verify unauthenticated access.

Administrator Role

Every workspace has an Administrator role with an admin policy and the fixed ID 00000000-0000-0000-0000-000000000002. You cannot rename or delete it.

Neither the Public role nor the Administrator role counts against the custom_roles license entitlement. See Licensing.