# AllowedAdditions

Type: Array<string>

Defines which types of additions are allowed when this entry is referenced by other entries
via `references`.

Semantics:
* Field absent (omitted) — no restriction; the referencing entry's own subjects, resources,
  and namespaces are merged in as usual. This is the upgrade-friendly default.
* Field present and empty (`[]`) — no additions allowed; only the referenced entry's content is
  effective.
* Field present with values — only the listed kinds of additions survive on the referencing entry.

This field is enforced as a runtime filter, not as a write-time policy contract: a referencing
entry that declares own subjects/resources/namespaces not permitted here can still be persisted,
but the disallowed own additions are silently stripped at enforcement time. The same filter
applies whether the reference is local (within the same policy) or an import reference.
* `subjects` — allows referencing entries to add additional subjects on top of this entry
* `resources` — allows referencing entries to add additional resources on top of this entry
* `namespaces` — allows referencing entries to add additional namespace patterns on top of this entry

Schema: [AllowedAdditions](https://sourcey-ditto.pages.dev/http-api-doc/models/allowedadditions.md)

Example:

```json
[
  "subjects"
]
```

Items:
  Type: string
  
  enum: ["subjects","resources","namespaces"]