Manifest reference

Every field of zaccess.yaml, product and resource manifests, and org rule files.

Editors validate these files with the JSON schemas in spec/: add # yaml-language-server: $schema=<url> at the top. zaccess check is the source of truth and enforces more than the schemas can.

Field	Required
`product`	yes	Path to the product manifest. Exactly one.
`resources`		Paths or globs of resource manifests.
`orgRules`		Paths or globs of org rule files. A glob may match nothing.
`tests`		Directory of Cerbos policy test suites. `zaccess gen` scaffolds one per new kind.
`out.policies`	yes	Directory Cerbos serves: resource policies, `_schemas/`, `orgs/`.
`out.manifest`	yes	The compiled `access.manifest.json`, read by both SDKs.
`out.ts`		A TypeScript module with `P` constants and the compiled manifest.
`out.go.file`, `out.go.package`		A Go file with permission constants and the embedded `Manifest`.

Product manifest

spec/manifest.schema.json. One per product.

Field
`product`	The product's name: `^[a-z][a-z0-9_-]*$`.
`scopeTypes.<name>`	A product scope type (see below). `global` and `self` are built in.
`systemRoles.<key>`	A role seeded into every org (see below). Keys are unique; `access_admin` is built in and can't be declared.

Scope types

Field	Kinds
`kind`	all	`prefix` or `set`.
`resourceAttr`	all	The resource attribute it reads. Every kind using the scope must declare it.
`principalAttr`	`prefix`	The principal attribute the resolver supplies (`reportingPath`). Paths start and end with `/`.
`excludeSelf`	`prefix`	Leave the user's own records out. Needs `ownerId` on the kind.
`expand`	`set`	Expand assigned IDs to everything below them with the resolver's `ExpandSet`.

System roles

Field
`name`	Shown to admins. Required.
`description`	Say which scope to assign it with.
`breakGlass`	`true`: assigning it needs a reason and an end at most 24 hours away; it can't be mapped to groups.
`permissions.<key>`	A mode: `inherit` (the assignment's scope), `self` or `global`. The mode must be one of the scopes the action allows. `"*": global` means every permission that may be granted globally.

Resource manifest

One per area of the product.

Field
`source`	Shown in the permission catalog (`leave-demo/leave`).
`resources.<kind>`	A resource kind: `^[a-z][a-z0-9_](\.[a-z][a-z0-9_])$`, unique across manifests, never `access.`.
`resources.<kind>.attributes.<name>`	An attribute (see below). `orgId` is added automatically; don't declare it.
`resources.<kind>.actions.<action>`	An action (see below). The permission key is `<kind>:<action>`; actions may contain colons.

Attributes

Either a type name, or an object:

attributes:
  ownerId: string                     # string | number | boolean
  status: { enum: [pending, approved] }
  note: { type: string, optional: true }

Field
`type`	`string`, `number` or `boolean`.
`enum`	Allowed values; strings only.
`optional`	May be absent. Required attributes must be on every check.

Actions

Field	Required
`description`	yes	What admins read in the role editor.
`scopes`	yes	The scopes it may be granted at: `global`, `self` and product scope types. `self` needs `ownerId`.
`condition`		A CEL expression over `R.attr.<declared>`, `P.id`, `P.attr.orgId` and scope principal attributes. Never `P.attr.perms`. Needs a policy test.
`sensitive`		Granting it globally needs a reason and is logged with high severity.

Org rule file

spec/org-rules.schema.json. One per org.

org: org_acme
rules:
  executive_salaries:
    description: Salaries in the executive unit are visible only to the person themselves.
    deny: [employee:read:salary]
    when: R.attr.orgUnitId == "exec" && R.attr.ownerId != P.id

Field
`org`	The org ID, as on the subject: letters, digits, `_` and `-`.
`rules.<name>.description`	Shown in Explain and decision logs.
`rules.<name>.deny`	Product permissions this rule denies. Never `access.*`.
`rules.<name>.when`	When it denies: the same variables as action conditions, required attributes only.

zynactra/access adds the access.* kinds (access.role, access.assignment, access.group_mapping, access.change_log, access.decision, access.delegation) and the access_admin role. See Roles and assignments.

zaccess.yaml