ReadonlyDescriptionHuman-readable description of what this provider covers.
ReadonlyDomainUnique name for this provider's domain; must match PermissionDomain.Name.
ReadonlySupportedWhat actions this provider can evaluate.
ReadonlySupportedWhat grantee types this provider supports.
ReadonlySupportsWhether this provider supports explicit Deny records.
Check if a user has a specific permission on a specific resource.
The user whose permissions are being checked (roles come from user.UserRoles).
The resource type within this domain (e.g., entity name, resource type name).
The specific resource ID; null for domain-wide checks.
The action being requested.
Optionalprovider: IMetadataProviderGet all effective permissions a user has on a specific resource. Returns an empty array when the user has no access.
Optionalprovider: IMetadataProviderGet all permissions this user has granted to other users within this domain. Powers the end-user Sharing Center's "Shared by me" tab.
Only meaningful for subsystems that support user-granted sharing (Dashboards,
Artifacts, Collections, Resource Permissions, Access Control Rules). Role-only
subsystems (Entity Permissions, Application Roles, AI Agent Permissions,
Query Permissions) return [].
Default implementation on PermissionProviderBase returns [], so
providers that don't support this shape don't have to override.
Optionalprovider: IMetadataProviderGet all permissions where this user is the direct grantee AND someone else is the grantor (or the resource owner). Powers the end-user Sharing Center's "Shared with me" tab — things other users have shared with me, excluding my own resources and role-inherited access.
Default returns [] — role-only subsystems have no "shared with me" concept.
Optionalprovider: IMetadataProviderGet all permissions granted on a specific resource across every grantee. Powers the Sharing Center's "Resource Access Report" view.
Optionalprovider: IMetadataProviderThe resource type names this provider operates on, suitable for populating
a "Resource Type" picker in admin reports. Providers with a single backing
table return a one-element array (e.g., ['Dashboards']). Providers that
span multiple (Resource Permissions, Entity Permissions, Access Control
Rules) return the live catalog. An empty array means "not enumerable" —
consumers can fall back to free-text input.
Optionalprovider: IMetadataProviderOptional metadata provider whose catalog to read. Falls back to
Metadata.Provider when omitted; pass an explicit provider in multi-tenant
contexts so the picker reflects the right server's entities.
Default implementation returns [].
Get all resources within this domain that the user has access to. Powers the Sharing Center's "User Access Report" view.
OptionalresourceType: stringOptional filter to one resource type within the domain.
Optionalprovider: IMetadataProvider
The contract every permission provider implements. Providers are thin facades over existing subsystem engines (EntityInfo.GetUserPermisions, DashboardEngine, etc.) — they translate between the provider-specific API and this normalized shape.
Concrete providers should NOT implement this interface directly — extend PermissionProviderBase instead so the class is registerable with ClassFactory.