Permissions' definition is explained in Social groups . Simplifying, definition is set of permissions related to a root, for example dossier:list,new,edit,delete, whereas checking a permission would take the form dossier:new. In the definition we say the permissions related to dossier, when checking we ask whether it has one of those permissions.

Permissions can be ORed using |, for example dossier:list|@customer:on.

Permission root types

• Entities, as defined in Elephant modules. dossier, contact, document are examples of those entities.
• Social groups, using the social group identifier prefixed with a @, and followed with :on.
• Roles, using the role name prefixed with a #, and followed with :on.
• Fuzzy roles, using the fuzzy role name prefixed with a @, and followed with :is.
• Actors, using a fixed root @actor:, and followed with the actor name.

Fuzzy roles

Fuzzy roles are those discovered by the application and highly dependent on interactions. Represented as @fuzzy_role:is.

Commodity roles

Elephant includes some commodity roles, not directly related to user's role:

Some examples

Suppose a sample user assigned to Privileged Customers social group. This social group grants the DossierParticipant role, which carries dossier=list,show permissions. Therefore, dossier:show will be granted.

Scriptable permissions

This feature is in its early stages and provides a more flexible way to use the permissions starting with a @. Adds the possibility of creating complex formulas, with preferences, negations and logical operators.