Introducing Policies
Policies define who has access to resources within our app and what actions they can run. Each resource can have its own set of policies, and each policy can apply to one or more actions defined in that resource.
Policies are checked internally by Ash before any action is run. If all policies that apply to a given action pass (return authorized), then the action is run. If one or more of the policies fail (return unauthorized), then the action is not run and an error is returned.
Because policies are part of resource definitions, they’re automatically checked on all calls to actions in those resources. Write them once, and they’ll apply everywhere: in our web UI, our REST and GraphQL APIs, an iex REPL, and any other interfaces ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access