Member Junction
    Preparing search index...

    Interface MJAIAgentUserPolicyEntity_IAgentUserEntityAccessRule

    Per-entity or wildcard entity access rule stored in the EntityAccessRules JSON array on MJ: AI Agent User Policies (AIAgentUserPolicy.EntityAccessRules).

    The owning user's MJ permissions (contextUser: Entity CRUD permissions, role-based Row-Level Security filters, and role-based Field-Level Security permissions) are the non-negotiable ceiling. Rules in this array strictly narrow access below that ceiling:

    • CRUD narrowing (Deny, ReadOnly, ReadWrite, RequireApprovalOnWrite)
    • Additional RLS narrowing (extra RowLevelSecurityFilter ID, SQL whereClause validated via SQLExpressionValidator, or in-memory recordConditionExpression evaluated via SafeExpressionEvaluator)
    • Additional FLS narrowing (deniedFields, readOnlyFields, requireApprovalFields)
    • Time-of-day / day-of-week / date-range windows (timeWindows)
    interface MJAIAgentUserPolicyEntity_IAgentUserEntityAccessRule {
        access: "ReadOnly" | "Deny" | "ReadWrite" | "RequireApprovalOnWrite";
        entityPattern: string;
        flsNarrowing?: {
            deniedFields?: string[];
            readOnlyFields?: string[];
            requireApprovalFields?: string[];
        };
        rlsNarrowing?: {
            recordConditionExpression?: string;
            rowLevelSecurityFilterId?: string;
            whereClause?: string;
        };
        timeWindows?: {
            daysOfWeek?: ("Sun" | "Mon" | "Tue" | "Wed" | "Thu" | "Fri" | "Sat")[];
            endTime?: string;
            outsideWindowBehavior?:
                | "ReadOnly"
                | "Deny"
                | "RequireApproval"
                | "DeferUntilNextWindow";
            startTime?: string;
            timezone?: string;
            validFromISO?: string;
            validUntilISO?: string;
        }[];
    }
    Index

    Properties

    access entityPattern flsNarrowing? rlsNarrowing? timeWindows?

    Properties

    access: "ReadOnly" | "Deny" | "ReadWrite" | "RequireApprovalOnWrite"

    Maximum CRUD mode allowed on matching entities. Intersected with contextUser's actual EntityPermission — never grants access the user does not already hold.

    entityPattern: string

    Exact MJ Entity Name or wildcard pattern (e.g. "*", "MJ_BizApps_Accounting:*", "MJ_BizApps_Sales: Deals").

    flsNarrowing?: {
        deniedFields?: string[];
        readOnlyFields?: string[];
        requireApprovalFields?: string[];
    }

    Optional Field-Level Security (FLS) narrowing — merged with the user's role FLS. Each array supports exact field names or * wildcard patterns (e.g. ["Salary", "*SSN*"]).

    Type Declaration

    • OptionaldeniedFields?: string[]

      Fields stripped from read projections and blocked from write mutations.

    • OptionalreadOnlyFields?: string[]

      Fields readable by the agent, but blocked from modification on Create/Update.

    • OptionalrequireApprovalFields?: string[]

      Modifying any matching field escalates the save to a user approval request (AIAgentRequest).

    rlsNarrowing?: {
        recordConditionExpression?: string;
        rowLevelSecurityFilterId?: string;
        whereClause?: string;
    }

    Optional Row-Level Security (RLS) narrowing — AND-combined with the user's role RLS.

    Type Declaration

    • OptionalrecordConditionExpression?: string

      Safe AST-validated boolean expression evaluated via SafeExpressionEvaluator against { record, user, now } before returning or saving a BaseEntity.

    • OptionalrowLevelSecurityFilterId?: string

      Optional ID of a reusable MJ: Row Level Security Filters record.

    • OptionalwhereClause?: string

      Inline SQL filter validated via SQLExpressionValidator (context: 'where_clause'). Supports user tokens such as {{UserID}} and {{UserEmail}}.

    timeWindows?: {
        daysOfWeek?: ("Sun" | "Mon" | "Tue" | "Wed" | "Thu" | "Fri" | "Sat")[];
        endTime?: string;
        outsideWindowBehavior?:
            | "ReadOnly"
            | "Deny"
            | "RequireApproval"
            | "DeferUntilNextWindow";
        startTime?: string;
        timezone?: string;
        validFromISO?: string;
        validUntilISO?: string;
    }[]

    Optional time-of-day / day-of-week windows restricting when access (especially writes) is permitted on matching entities.

    Type Declaration

    • OptionaldaysOfWeek?: ("Sun" | "Mon" | "Tue" | "Wed" | "Thu" | "Fri" | "Sat")[]

      Allowed days of week (e.g. ['Mon', 'Tue', 'Wed', 'Thu', 'Fri']).

    • OptionalendTime?: string

      24-hour end time in HH:mm format (e.g. "18:00").

    • OptionaloutsideWindowBehavior?: "ReadOnly" | "Deny" | "RequireApproval" | "DeferUntilNextWindow"

      Behavior when an operation is attempted outside the allowed window:

      • 'Deny': Reject immediately
      • 'ReadOnly': Allow reads, block writes
      • 'RequireApproval': Create an AIAgentRequest for user approval
      • 'DeferUntilNextWindow': Return nextWindowStartISO so the agent can self-schedule an AgentWake
    • OptionalstartTime?: string

      24-hour start time in HH:mm format (e.g. "08:00").

    • Optionaltimezone?: string

      IANA timezone (e.g. "America/Chicago"); defaults to UTC when omitted.

    • OptionalvalidFromISO?: string

      Optional ISO-8601 start timestamp for temporary grants.

    • OptionalvalidUntilISO?: string

      Optional ISO-8601 end timestamp for temporary grants.

    Settings

    Member Visibility

    On This Page

    Properties