Global Rules
Wildcard rules that apply outside the organization tree.
Most rules live inside an organization. Global rules deliberately sit outside
the tree: morbac.global_rules rows have no org and no role, and their NULLs
are wildcards.
| Column | NULL means |
|---|---|
user_id | every user |
activity | any activity |
view | any view |
The canonical use is the bootstrap administrator: one row with
user_id = <admin>, activity = NULL, view = NULL, modality permission
grants everything, everywhere (recipe).
The inverse works too: a targeted global prohibition bans a user from one view across every organization at once:
INSERT INTO morbac.global_rules (user_id, activity, view, context_id, modality, priority)
VALUES (:olivier, NULL, 'invoices',
(SELECT id FROM morbac.contexts WHERE name = 'always'),
'prohibition', 100);A global permission applies in every org of every tenant, and also to checks with no org at all. Grant wildcards only to real administrators; for anything narrower, scope the rule on activity or view.
Global rules are evaluated at steps 3.5 (prohibitions) and 6.5 (permissions) of the decision algorithm, with the same priority semantics as every other store.
For accounts that must never be blocked at all, see system principals.