Sharing schema — Security Protocol reference Sharing schemas of the ObjectStack Security Protocol: CriteriaSharingRule, OWDModel and 4 more — each property with its type, default and a TypeScript example.
Source: packages/spec/src/security/sharing.zod.ts
import { CriteriaSharingRuleSchema, OWDModel, ShareRecipientType, SharingLevel, SharingRuleSchema, SharingRuleType } from '@objectstack/spec/security' ; import type { CriteriaSharingRule, OWDModel, ShareRecipientType, SharingLevel, SharingRule, SharingRuleType } from '@objectstack/spec/security' ; // Validate data const result = CriteriaSharingRuleSchema. parse (data); Property Type Required Description name string✅ Unique rule name (snake_case) label stringoptional Human-readable label description stringoptional Administrative notes object string✅ Target Object Name active booleanoptional (default: true) accessLevel Enum<'read' | 'edit'>optional (default: "read") sharedWith { type: Enum<'user' | 'team' | 'position' | 'unit_and_subordinates' | 'business_unit' | 'field'>; value: string }✅ The recipient of the shared access: a principal resolved once per rule, or — type: field — the user or users named by a field on each matched record _lock Enum<'none' | 'no-overlay' | 'no-delete' | 'full'>optional Item-level lock — controls overlay & delete (ADR-0010). _lockReason stringoptional Human-readable reason shown when a write is refused by _lock. _lockSource Enum<'artifact' | 'package' | 'env-forced'>optional Layer that set _lock (artifact | package | env-forced). _provenance Enum<'package' | 'org' | 'env-forced'>optional Origin of the item (package | org | env-forced). _packageId stringoptional Owning package machine id. _packageVersion stringoptional Owning package version. _lockDocsUrl stringoptional Optional documentation link surfaced next to _lockReason. type 'criteria'✅ condition string | { dialect: Enum<'cel' | 'cron' | 'template'>; source: string; ast?: any; meta?: object }✅ Predicate (CEL). e.g. Precord.department == "Sales"
Property Type Required Description type Enum<'user' | 'team' | 'position' | 'unit_and_subordinates' | 'business_unit' | 'field'>✅ value string✅ The recipient principal: the id or code of the user / team / position / business unit — or, for type: 'field', the snake_case name of a user-typed field on the record whose value names the user or users to share each matched record with
privatepublic_readpublic_read_writecontrolled_by_parent
userteampositionunit_and_subordinatesbusiness_unitfield
Property Type Required Description name string✅ Unique rule name (snake_case) label stringoptional Human-readable label description stringoptional Administrative notes object string✅ Target Object Name active booleanoptional (default: true) accessLevel Enum<'read' | 'edit'>optional (default: "read") sharedWith { type: Enum<'user' | 'team' | 'position' | 'unit_and_subordinates' | 'business_unit' | 'field'>; value: string }✅ The recipient of the shared access: a principal resolved once per rule, or — type: field — the user or users named by a field on each matched record _lock Enum<'none' | 'no-overlay' | 'no-delete' | 'full'>optional Item-level lock — controls overlay & delete (ADR-0010). _lockReason stringoptional Human-readable reason shown when a write is refused by _lock. _lockSource Enum<'artifact' | 'package' | 'env-forced'>optional Layer that set _lock (artifact | package | env-forced). _provenance Enum<'package' | 'org' | 'env-forced'>optional Origin of the item (package | org | env-forced). _packageId stringoptional Owning package machine id. _packageVersion stringoptional Owning package version. _lockDocsUrl stringoptional Optional documentation link surfaced next to _lockReason. type 'criteria'✅ condition string | { dialect: Enum<'cel' | 'cron' | 'template'>; source: string; ast?: any; meta?: object }✅ Predicate (CEL). e.g. Precord.department == "Sales"
Property Type Required Description type Enum<'user' | 'team' | 'position' | 'unit_and_subordinates' | 'business_unit' | 'field'>✅ value string✅ The recipient principal: the id or code of the user / team / position / business unit — or, for type: 'field', the snake_case name of a user-typed field on the record whose value names the user or users to share each matched record with
ObjectStack