From 6c22088daa38243800a453c7456288ac5446ed55 Mon Sep 17 00:00:00 2001 From: Peter Macdonald Date: Tue, 24 Mar 2026 16:13:35 +0100 Subject: [PATCH] updates based on feedback Signed-off-by: Peter Macdonald --- docs/golden-path/plugins/integrations/003-permissions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/golden-path/plugins/integrations/003-permissions.md b/docs/golden-path/plugins/integrations/003-permissions.md index 2da086e7f2..3cbba161fb 100644 --- a/docs/golden-path/plugins/integrations/003-permissions.md +++ b/docs/golden-path/plugins/integrations/003-permissions.md @@ -15,7 +15,7 @@ There are two kinds of permissions: _Basic permissions_ apply to actions that don't relate to a specific resource. Creating a todo is a good example: the action either is or isn't allowed, regardless of which todo you're creating. The policy returns a definitive ALLOW or DENY. -_Resource permissions_ apply to actions on a specific resource. Reading a particular todo is a good example: whether you're allowed might depend on whether you created it. The policy can return a CONDITIONAL decision, meaning the framework evaluates the condition against the actual resource before deciding. +_Resource permissions_ apply to actions on a specific resource. Reading a particular todo is a good example: whether you're allowed might depend on whether you created it. In addition to the basic ALLOW or DENY, the policy can return a CONDITIONAL decision. CONDITIONAL decisions are required to be evaluated against a specific resource and will produce a per-resource ALLOW or DENY. The framework sits between your route handlers and your business logic. Your handler asks "is this allowed?", the framework consults the active policy, and your handler either proceeds or throws a `NotAllowedError`.