Permissions
A permission is a named authorization to perform a particular operation or access a protected capability. Permissions answer what action is allowed; content rules can additionally answer which records are in scope.
Granularity
Section titled “Granularity”Permissions are grouped by protected domain and action, such as read, write, delete, manage, execute, or administer. The exact catalog evolves with Cove capabilities, so the running instance’s role editor and API authorization remain authoritative for available permission names.
Evaluation
Section titled “Evaluation”Permissions normally arrive through roles, with special instance ownership behavior where supported. Having a UI route visible or knowing an API endpoint does not grant its permission. Server-side authorization evaluates each protected request.
For read access, a matching allow content rule can expose scoped records without the general role read permission. For writes and deletes, a content rule cannot replace the underlying role permission; it can only restrict its record scope.
What a read permission allows
Section titled “What a read permission allows”A read permission authorizes reading entities of its kind and writing the principal’s own personal state about them: bookmarks, favorites, ratings, and playback history. Personal state is per-user and invisible to others, so recording it does not require the write permission that changing the shared record would. See Personal state.
Extension distinction
Section titled “Extension distinction”User permissions are not the same as extension manifest permission declarations. User permissions authorize an authenticated principal. Manifest declarations describe access an installed package expects and are not a runtime sandbox.