Allowed hold modes
- Type
- hold_allowed_modes
- Category
- Holds
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegrationDevice
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
- DefaultWhat happens when no row of this type is configured.
- Not configured — both hold-open and hold-closed are allowed.
Intersects the hold modes a bound principal may set. Use this to allow hold-closed (stay locked / stay off) without allowing hold-open (stay unlocked / stay on), or the reverse. Opening class still forbids hold-closed and hold-open on means_of_egress and fire_door_assembly regardless of this policy. See [Life safety and egress](/docs/guides/access-control-architecture/life-safety-and-egress/).
When it is enforced
Evaluated when someone creates or updates an invitation, hold, or share. Requests that would exceed the limit are rejected — they are not silently rewritten.
Where to set it
Settings → Policies (org), the integration Policies tab, or — on PalGate — the device steward Policies tab.
Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.
Arguments
The config object on create/update. Shared row fieldsenforcement (enforce, require_approval,audit_only) and enabled apply to every type;audit_only and disabled rows never block.
| Name | Type | Required | Values | Description |
|---|---|---|---|---|
| modes | string[] | Yes | hold_openhold_closed | Non-empty allow-list of hold modes. Combination intersects the sets. |
| applies_to | string or string[] | No | agentapi_keyinvitationmemberresidentadminall | Principal kinds this row binds. Closed set: agent, api_key, invitation, member, resident, admin, all. Unknown strings and empty arrays are rejected. `all` matches every kind. When omitted, the type-specific default applies (see Default). Device-tier rows without `applies_to` often bind everyone, including admins. Default: Org/integration: member and resident. Device-tier without applies_to: everyone, including admins. |
| output | string or integer | No | — | Optional channel or output id. When set, the policy binds only that output. When omitted, it binds every output of the tier target. A scoped row does not apply when the acting output is unknown. |
How overlapping rows combine
Intersection of modes arrays across applicable rows.
Example
A resident can hold a door closed, but cannot hold it open. An admin (unless included in applies_to) is unaffected.
{ "modes": [ "hold_closed" ]}Integrations
This type is documented on these connectors:
- Home Assistant (home_assistant)
- KNX (knx)
- MQTT (mqtt)
- PalGate Cloud (palgate_cloud)
- Shelly Cloud (shelly_cloud)
- Shelly Websocket (shelly_websocket)
- Tasmota (tasmota)
- Virtual Access (virtual_access)
- Virtual Demo Devices (virtual_demo)
- Waveshare (waveshare)
Related
- Policy catalog
- Policies architecture guide
- No holds (hold_forbidden)
- Require hold expiry (hold_require_expiry)