Sharing

Organization-Wide Defaults (OWD) The baseline security posture for an object.

Source: packages/spec/src/security/sharing.zod.ts

TypeScript Usage

import { CriteriaSharingRuleSchema, OWDModel, ShareRecipientType, SharingLevel, SharingRuleSchema, SharingRuleType } from '@objectstack/spec/security';
import type { CriteriaSharingRule, OWDModel, ShareRecipientType, SharingLevel, SharingRule, SharingRuleType } from '@objectstack/spec/security';

// Validate data
const result = CriteriaSharingRuleSchema.parse(data);

CriteriaSharingRule

Properties

Property	Type	Required	Description
name	`string`	✅	Unique rule name (snake_case)
label	`string`	optional	Human-readable label
description	`string`	optional	Administrative notes
object	`string`	✅	Target Object Name
active	`boolean`	optional
accessLevel	`Enum<'read' \| 'edit'>`	optional
sharedWith	`{ type: Enum<'user' \| 'team' \| 'position' \| 'unit_and_subordinates' \| 'business_unit'>; value: string }`	✅	The recipient of the shared access
_lock	`Enum<'none' \| 'no-overlay' \| 'no-delete' \| 'full'>`	optional	Item-level lock — controls overlay & delete (ADR-0010).
_lockReason	`string`	optional	Human-readable reason shown when a write is refused by _lock.
_lockSource	`Enum<'artifact' \| 'package' \| 'env-forced'>`	optional	Layer that set _lock (artifact \| package \| env-forced).
_provenance	`Enum<'package' \| 'org' \| 'env-forced'>`	optional	Origin of the item (package \| org \| env-forced).
_packageId	`string`	optional	Owning package machine id.
_packageVersion	`string`	optional	Owning package version.
_lockDocsUrl	`string`	optional	Optional documentation link surfaced next to _lockReason.
type	`'criteria'`	✅
condition	`string \| { dialect: Enum<'cel' \| 'cron' \| 'template'>; source?: string; ast?: any; meta?: object }`	✅	Predicate (CEL). e.g. P`record.department == "Sales"`

OWDModel

Allowed Values

private
public_read
public_read_write
controlled_by_parent

ShareRecipientType

Allowed Values

user
team
position
unit_and_subordinates
business_unit

SharingLevel

Allowed Values

read
edit

SharingRule

Properties

Property	Type	Required	Description
name	`string`	✅	Unique rule name (snake_case)
label	`string`	optional	Human-readable label
description	`string`	optional	Administrative notes
object	`string`	✅	Target Object Name
active	`boolean`	optional
accessLevel	`Enum<'read' \| 'edit'>`	optional
sharedWith	`{ type: Enum<'user' \| 'team' \| 'position' \| 'unit_and_subordinates' \| 'business_unit'>; value: string }`	✅	The recipient of the shared access
_lock	`Enum<'none' \| 'no-overlay' \| 'no-delete' \| 'full'>`	optional	Item-level lock — controls overlay & delete (ADR-0010).
_lockReason	`string`	optional	Human-readable reason shown when a write is refused by _lock.
_lockSource	`Enum<'artifact' \| 'package' \| 'env-forced'>`	optional	Layer that set _lock (artifact \| package \| env-forced).
_provenance	`Enum<'package' \| 'org' \| 'env-forced'>`	optional	Origin of the item (package \| org \| env-forced).
_packageId	`string`	optional	Owning package machine id.
_packageVersion	`string`	optional	Owning package version.
_lockDocsUrl	`string`	optional	Optional documentation link surfaced next to _lockReason.
type	`'criteria'`	✅
condition	`string \| { dialect: Enum<'cel' \| 'cron' \| 'template'>; source?: string; ast?: any; meta?: object }`	✅	Predicate (CEL). e.g. P`record.department == "Sales"`

SharingRuleType

Allowed Values

criteria

On this page