Access control reference

This page lists access patterns, the access-control lists (ACLs) for resource objects, special objects, and selected Core APIs. For objects and subjects, see Authentication and access control; for the rules behind the tables, see Authorization rules and spaces and Public and private access.

Authorization rule notation

DIAL authorization is expressed as a rule granting a set of subjects a set of actions on a set of objects:

(object: {set-of-objects}, subject: {set-of-subjects}, action: {actions})

This notation is a documentation convention, not the internal storage format. The tokens below appear throughout the rules.

Token	Meaning
public:*	Any object in the public space.
private:subject_id:*	Any object in the private space of the subject identified by subject_id.
private:subject_id:app_id:*	Any object in the application app_id subfolder of a subject's private space.
private:app_id:*	Any object in the application's own private space.
subject: *	Any subject.
role:admin	Any subject in the DIAL Administrators role.
subject_id	A unique identifier of a single user or API key.

Default rules

Rule	Effect
(object: public:*, subject: *, action: read)	Read-only access to public objects for everyone.
(object: public:*, subject: role:admin, action: *)	Full access to public objects for DIAL Administrators.
(object: private:subject_id:*, subject: subject_id, action: *)	Full access to a subject's own private objects.

Access patterns

Space	Access pattern	Description
Public space	Public objects	Read-only access to public objects without restrictions. For executable objects such as applications, routes, or toolsets, this also includes execute and call permissions.
Public space	Restricted objects	Read-only access to objects with matching rules.
Public space	Admin access	Full read/write access to any object in the public space; management of DIAL Core configuration files; approval and rejection of publication requests.
Private space	Own objects	Full read/write access to any object in the subject's own private space; submission of publication requests; creation of sharing links.
Private space	Own objects per application	Full access to any object in an application-specific subfolder within the subject's own private space.
Private space	Application objects	Full access to any object in the application's own private space.
Private space	Shared objects	Access to a shared object at the level defined in the sharing link: read, read/write, and optionally re-share.

ACLs for objects

The columns are the four subject categories. Per-request key permissions do not apply to administrators.

The tables describe the default model for these subjects. A configured global reader has additional read access to public and private resources. Request-attached files also grant applications access for the request lifetime; see Per-request keys.

Object	DIAL Administrator	User without role	User / API key with role(s)	Per-request key
Models — managed as DIAL Core configuration entities	Public space: Admin access. Private space: N/A	Public space: Public objects. Private space: N/A	Public space: Public objects, Restricted objects. Private space: N/A	Public space: Public objects, Restricted objects. Private space: N/A
Applications	Public space: Admin access. Private space: Own objects, Shared objects	Public space: Public objects. Private space: Own objects, Shared objects	Public space: Public objects, Restricted objects. Private space: Own objects, Shared objects	Public space: Public objects, Restricted objects. Private space: Own objects per application, Application objects
Toolsets	Public space: Admin access. Private space: Own objects, Shared objects	Public space: Public objects. Private space: Own objects, Shared objects	Public space: Public objects, Restricted objects. Private space: Own objects, Shared objects	Public space: Public objects, Restricted objects. Private space: Own objects per application, Application objects
Routes — managed as DIAL Core configuration entities	Public space: Admin access. Private space: N/A	Public space: Public objects. Private space: N/A	Public space: Public objects, Restricted objects. Private space: N/A	Public space: Public objects, Restricted objects. Private space: N/A
Files	Public space: Admin access. Private space: Own objects, Shared objects	Public space: Public objects. Private space: Own objects, Shared objects	Public space: Public objects, Restricted objects. Private space: Own objects, Shared objects	Public space: Public objects, Restricted objects. Private space: Own objects per application, Application objects
Prompts	Public space: Admin access. Private space: Own objects, Shared objects	Public space: Public objects. Private space: Own objects, Shared objects	Public space: Public objects, Restricted objects. Private space: Own objects, Shared objects	Public space: Public objects, Restricted objects. Private space: Own objects per application, Application objects
Conversations	Public space: Admin access. Private space: Own objects, Shared objects	Public space: Public objects. Private space: Own objects, Shared objects	Public space: Public objects, Restricted objects. Private space: Own objects, Shared objects	Public space: Public objects, Restricted objects. Private space: Own objects per application, Application objects

ACLs for special objects

Special objects are part of DIAL's authorization system and belong to neither the public nor the private space. A + denotes access; a - denotes no access. Administrators manage platform-defined entities through the preview Configuration API or DIAL Admin. File-defined entities are changed in the configuration files. The API does not return stored key secrets.

Object	DIAL Administrator	User without role	User / API key with role(s)	Per-request key
Keys — configuration entities. A caller authenticated by an API key can call /v1/user/info to obtain limited information about that caller; this does not grant access to key configuration.	+	-	-	-
Roles — configuration entities; management requires administrator access.	+	-	-	-

ACLs for Core APIs not related to objects

Core API	DIAL Administrator	User without role	User / API key with role(s)	Per-request key
Get user info	+	+	+	+
Reload DIAL Core config	+	-	-	-

Further reading

• Authorization rules and spaces — authorization-rule notation and the public-space hierarchy
• Public and private access — how to narrow public access and extend private access through sharing
• Authentication and access control — the model behind these tables
• DIAL Core settings: Access — admin rules, API-key IP checks, and sharing lifetimes
• Roles and rate limits — define roles and bind permissions to them
• API keys — create and configure API keys