# PolicyEntry

Type: PolicyEntry

Single policy entry. Both `subjects` and `resources` are optional — they
default to empty when absent. An entry may define `references` to inherit
subjects, resources, and namespaces from other entries (local or imported).

Schema: [PolicyEntry](https://sourcey-ditto.pages.dev/http-api-doc/models/policyentry.md)

- `subjects` (optional)
  Reference: [Subjects](https://sourcey-ditto.pages.dev/http-api-doc/models/subjects.md); Type: Subjects
  
  A SubjectEntry defines who is addressed.

- `resources` (optional)
  Reference: [Resources](https://sourcey-ditto.pages.dev/http-api-doc/models/resources.md); Type: Resources
  
  (Authorization) Resources containing one ResourceEntry for each
  `type:path` key, `type` being one of the following `thing`, `policy`, `message`.
  
  Example:
  
  ```json
  {
    "thing:/": {
      "grant": [
        "READ",
        "WRITE"
      ],
      "revoke": null
    },
    "thing:/attributes/some/path": {
      "grant": null,
      "revoke": [
        "READ"
      ]
    },
    "policy:/": {
      "grant": [
        "READ",
        "WRITE"
      ],
      "revoke": null
    },
    "message:/": {
      "grant": [
        "READ",
        "WRITE"
      ],
      "revoke": null
    }
  }
  ```

- `namespaces` (optional)
  Type: Array<string>
  
  Restricts this policy entry to things whose namespace matches at least one pattern.
  If omitted or empty, the entry applies to all namespaces.
  * `com.acme` matches only that exact namespace
  * `com.acme.*` matches namespaces below `com.acme`, but not `com.acme` itself
  
  Example:
  
  ```json
  [
    "com.acme",
    "com.acme.*"
  ]
  ```
  
  Items:
    Type: string

- `importable` (optional)
  Reference: [Importable](https://sourcey-ditto.pages.dev/http-api-doc/models/importable.md); Type: Importable
  
  Controls the import behavior of this policy entry i.e. whether this policy entry is implicitly, 
  explicitly or never imported when referenced from another policy.
  * `implicit` (default): the policy entry is imported without being listed in the importing policy individually
  * `explicit`: the policy entry is only imported if it is listed in the importing policy
  * `never`: the policy entry is not imported, regardless of being listed in the importing policy
  If the field is not specified, default value is `implicit`.
  
  default: "implicit"
  
  enum: ["implicit","explicit","never"]
  
  Example:
  
  ```json
  "explicit"
  ```

- `allowedAdditions` (optional)
  Reference: [AllowedAdditions](https://sourcey-ditto.pages.dev/http-api-doc/models/allowedadditions.md); Type: Array<string>
  
  Defines which types of additions are allowed when this entry is referenced by other entries
  via `references`.
  
  Semantics:
  * Field absent (omitted) — no restriction; the referencing entry's own subjects, resources,
    and namespaces are merged in as usual. This is the upgrade-friendly default.
  * Field present and empty (`[]`) — no additions allowed; only the referenced entry's content is
    effective.
  * Field present with values — only the listed kinds of additions survive on the referencing entry.
  
  This field is enforced as a runtime filter, not as a write-time policy contract: a referencing
  entry that declares own subjects/resources/namespaces not permitted here can still be persisted,
  but the disallowed own additions are silently stripped at enforcement time. The same filter
  applies whether the reference is local (within the same policy) or an import reference.
  * `subjects` — allows referencing entries to add additional subjects on top of this entry
  * `resources` — allows referencing entries to add additional resources on top of this entry
  * `namespaces` — allows referencing entries to add additional namespace patterns on top of this entry
  
  Example:
  
  ```json
  [
    "subjects"
  ]
  ```

- `references` (optional)
  Reference: [References](https://sourcey-ditto.pages.dev/http-api-doc/models/references.md); Type: Array<object>
  
  An optional list of references to other policy entries. Each reference points to an entry
  either in the same policy (local reference) or in an imported policy (import reference).
  When set, subjects, resources, and namespaces from the referenced entries are additively
  merged into this entry.
  
  * Import reference: contains both `entry` (the label) and `import` (the policy ID of the imported policy)
  * Local reference: contains only `entry` (the label of another entry in the same policy)
  
  Example:
  
  ```json
  [
    {
      "entry": "operator",
      "import": "energy-corp:power-plant-roles"
    },
    {
      "entry": "local-admin"
    }
  ]
  ```