Authorization

This page is the canonical authorization reference for Zeptoz collection and file routes.

Roles

Roles in Zeptoz:

• owner
• admin
• member

Default role on user registration is member.

Authorization order (canonical)

For collection CRUD routes, Zeptoz evaluates authorization in this order:

1. authenticate request
2. role bypass (owner and admin)
3. collection Access Policy for the requested operation (list, view, create, update, delete) when policy is set
4. legacy fallback behavior when policy is unset

Access model in place

Area	owner	admin	member
Collection access policy bypass	allowed	allowed	not allowed
Collection op with policy set	bypass policy	bypass policy	evaluated by policy
Collection POST/PATCH/DELETE with unset policy	allowed	allowed	forbidden
Collection GET/list with unset policy	allowed	allowed	allowed
File access to any file	allowed	allowed	not allowed
File access to own file	allowed	allowed	allowed

Access policy expression context

Access Policy expressions can reference:

• @request.auth.id
• @request.auth.roles
• @request.data.<field> (create/update)
• @request.query.<field> (list)
• @record.<field> (view/update/delete)

Supported operators include =, !=, &&, ||, contains, is null, and is not null.

Notes

• Collection operations evaluate Access Policies (list/view/create/update/delete) when configured.
• Unset collection policies fall back to legacy behavior from the table above.
• File authorization is separate from collection policies; member can only download/delete files where owner_id matches the user.
• Policy parse/evaluation failures are deny-safe and return forbidden responses.