Global Rules
Wildcard rules that apply outside the organization tree.
Most rules live inside an organization. Global rules deliberately sit outside
the tree: morbac.global_rules rows have no org and no role, and their NULLs
are wildcards.
| Column | NULL means |
|---|---|
user_id | every user |
activity | any activity |
view | any view |
These NULLs are wildcards over users, activities and views. This is the one place NULL widens rather than narrows, and the table has no org column at all. In the org dimension a NULL always means unattributed, never "any".
A global rule covers all organizations and unattributed records together.
When you want one of those alone, keep it in morbac.rules where the target is
explicit:
| You want | Write |
|---|---|
| Every org and no-org records, no role needed | global_rules |
| Every org and no-org records, tied to a role | rules with scope = all |
| Only records with no org | rules with scope = unattributed |
Reach for a global rule when the grant genuinely has no organizational boundary. A role-based rule keeps the grant revocable by role assignment, which is usually what you want.
The canonical use is the bootstrap administrator: one row with
user_id = <admin>, activity = NULL, view = NULL, modality permission
grants everything, everywhere (recipe).
The inverse works too: a targeted global prohibition bans a user from one view across every organization at once:
INSERT INTO morbac.global_rules (user_id, activity, view, context_id, modality, priority)
VALUES (:olivier, NULL, 'invoices',
(SELECT id FROM morbac.contexts WHERE name = 'always'),
'prohibition', 100);A global permission applies in every org of every tenant, and also to checks with no org at all. Grant wildcards only to real administrators; for anything narrower, scope the rule on activity or view.
Global rules are evaluated at steps 3.5 (prohibitions) and 6.5 (permissions) of the decision algorithm, with the same priority semantics as every other store.
For accounts that must never be blocked at all, see system principals.