Misc schema — Security Protocol reference
Misc schemas of the ObjectStack Security Protocol: CapabilityDeclaration and 4 more — each property with its type, default and a TypeScript example.
import { CapabilityDeclarationSchema, OrgScopingEntitlementSchema, PlatformGlobalObjectsSchema, TenancyPostureSchema, TenantLayer0VerdictSchema } from '@objectstack/spec/security';
import type { CapabilityDeclaration, OrgScopingEntitlement, PlatformGlobalObjects, TenancyPosture, TenantLayer0Verdict } from '@objectstack/spec/security';
// Validate data
const result = CapabilityDeclarationSchema.parse(data);
| Property | Type | Required | Description |
|---|
| name | string | ✅ | Stable capability key referenced by systemPermissions / requiredPermissions |
| label | string | optional | Human label shown in Setup |
| description | string | optional | What holding this capability permits |
| scope | Enum<'platform' | 'org'> | optional (default: "platform") | platform = a platform-wide power; org = scoped to an organization |
| packageId | string | optional | [ADR-0086 D3] Owning package id (author-declared fallback; absent = registry-stamped) |
| _lock | Enum<'none' | 'no-overlay' | 'no-delete' | 'full'> | optional | Item-level lock — controls overlay & delete (ADR-0010). |
| _lockReason | string | optional | Human-readable reason shown when a write is refused by _lock. |
| _lockSource | Enum<'artifact' | 'package' | 'env-forced'> | optional | Layer that set _lock (artifact | package | env-forced). |
| _provenance | Enum<'package' | 'org' | 'env-forced'> | optional | Origin of the item (package | org | env-forced). |
| _packageId | string | optional | Owning package machine id. |
| _packageVersion | string | optional | Owning package version. |
| _lockDocsUrl | string | optional | Optional documentation link surfaced next to _lockReason. |
| Property | Type | Required | Description |
|---|
| supportedPostures | Enum<'single' | 'group' | 'isolated'>[] | optional | |
| platformGlobalObjects | string[] | optional | |
| suppressUnboundedOrgAdminGrant | boolean | optional | |
Type: string[]
This schema accepts one of the following structures:
| Property | Type | Required | Description |
|---|
| kind | 'none' | ✅ | |
| Property | Type | Required | Description |
|---|
| kind | 'organization' | ✅ | |
| organizationId | string | ✅ | |
| Property | Type | Required | Description |
|---|
| kind | 'organizations' | ✅ | |
| organizationIds | string[] | ✅ | |
| Property | Type | Required | Description |
|---|
| kind | 'deny' | ✅ | |
ObjectStack