Skip to content
OpenAppPhysical access, fully managed
Login

Agent group write

Type
agent_group_write
Category
Sharing
Enforced at
Access-time
Tiers
Org
Enforcement
Enforce
Default
Not configured — agents cannot reach group routes.

Agents cannot reach any group route by default. While an enforcing row of this type applies to the organization that owns an agent, an admin can mint that agent a credential with group roles (`group_roles` on `POST /agents/{id}/credentials`), and the credential can use them. Each role must be one the admin holds in the agent’s organization. The roles work only in the agent’s own organization and its sub-organizations, whatever the X-Org header names. The policy is re-checked on every request, so disabling or deleting the row cuts off existing credentials at once (403 `agent_capability_disabled`). API keys and voice keys never reach group routes. Household self-service and group photos stay unreachable to agents. Group changes an agent makes are audited with the agent as the actor. This is the second policy that relaxes rather than restricts, after emergency free egress. The config is empty: `{}`.

When it is enforced

Evaluated when someone opens a door or gate or triggers an entity action. If this policy applies, the open is denied even when roles and grants would otherwise allow it.

Where to set it

Settings → Policies (org).

Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.

Arguments

The config object on create/update. Row fields outsideconfig are enforcement (this type acceptsenforce; any other value is rejected with 400), enabled (disabled rows never apply), and capability.

NameTypeRequiredValuesDescription

How overlapping rows combine

Any applicable enforcing row in the agent’s organization or an ancestor enables it.

Example

A roster-sync agent minted with groups:read and groups:update adds and removes class members. Disabling the row makes its next group request fail with 403.

config
{}

Integrations

This type is documented on these connectors: