How access works

Five parts of access

Part	Examples
Who	Person, local group, external group, or service
Item	Product area, type of item, or named item
Action	View, Search, Run, Create, Update, Work, Publish, or Delete
Result	Allow or Deny
Time	Start date and end date

How Pūnaha decides

Pūnaha combines access from roles, direct assignments, and groups. A matching Deny wins over an Allow.

The API checks the exact item and action for every request.

Administration is separate

Permission to manage access does not give permission to use the item. Permission to manage people is also separate.

Check one question

Use Check access for one person, item, and action. Use Effective access when you need to see all sources together.