Allowed entry kinds

Type

invitation_allowed_entry_kinds

Category

Invitations

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.

Enforce

DefaultWhat happens when no row of this type is configured.

Not configured — any portal entry kind may be granted.

Every granted portal’s entry_kind must be in the intersection of allowed sets. Use this so guests can get apartment doors but not a vehicle boom-gate, for example.

When it is enforced

Evaluated when someone creates or updates an invitation, hold, or share. Requests that would exceed the limit are rejected — they are not silently rewritten.

Where to set it

Settings → Policies (org), the integration Policies tab, or — on PalGate — the device steward Policies tab.

Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.

Arguments

The config object on create/update. Shared row fieldsenforcement (enforce, require_approval,audit_only) and enabled apply to every type;audit_only and disabled rows never block.

Name	Type	Required	Values	Description
kinds	string[]	Yes	doorgateboom-gate	Non-empty allow-list of portal entry kinds.
output	string or integer	No	—	Optional channel or output id. When set, the policy binds only that output. When omitted, it binds every output of the tier target. A scoped row does not apply when the acting output is unknown.

How overlapping rows combine

Intersection of kinds arrays. Empty intersection means nothing may be granted.

Example

An invitation that includes a boom-gate portal is rejected.

config

{
  "kinds": [
    "door",
    "gate"
  ]
}

Integrations

This type is documented on these connectors:

• Home Assistant (home_assistant)
• KNX (knx)
• MQTT (mqtt)
• PalGate Cloud (palgate_cloud)
• Shelly Cloud (shelly_cloud)
• Shelly Websocket (shelly_websocket)
• Tasmota (tasmota)
• Virtual Access (virtual_access)
• Virtual Demo Devices (virtual_demo)
• Waveshare (waveshare)

Related

• Policy catalog
• Policies architecture guide
• Max doors per invitation (max_doors_per_invite)
• Own-apartment doors only (restrict_to_own_apartment_doors)
• Prohibit master-door invitations (prohibit_master_door_invites)

Typed configuration

The OpenAPI contract names this object InvitationAllowedEntryKindsPolicyConfig:

{
  "kinds": ["door", "gate"],
  "output": "main"
}

kinds is a non-empty allow-list of door, gate, and boom-gate.