pgmorbacMulti-OrBAC for PostgreSQL
    DocumentationDownloadSource
    Use cases
    • How do I...?
    Getting Started
    • Introduction
    • Quick start
    • How pgmorbac compares
    • Upgrade
    Concepts
    • Organizations
    • Roles
    • Activities
    • Views
    • Contexts
    • Rules & Modalities
    • Global Rules
    • System Principals
    • Constraints
    • Row-Level Security
    • Decision Cache
    Resolution
    • is_allowed
    Recipes
    • Org Hierarchies
    • Multi-Tenant Isolation
    • Wildcard Admin
    • Delegation
    • Service Accounts
    • Deny Rules
    • Separation of Duty
    • Derived Roles
    • Cross-Org Access
    • Obligations & Recommendations
    • Temporal Access
    Integration
    • Fastify
    • PostgREST & RLS Context
    • SQL Only
    Reference
    • Function Reference
    Concepts

    Global Rules

    Wildcard rules that apply outside the organization tree.

    Most rules live inside an organization. Global rules deliberately sit outside the tree: morbac.global_rules rows have no org and no role, and their NULLs are wildcards.

    ColumnNULL means
    user_idevery user
    activityany activity
    viewany view

    These NULLs are wildcards over users, activities and views. This is the one place NULL widens rather than narrows, and the table has no org column at all. In the org dimension a NULL always means unattributed, never "any".

    A global rule covers all organizations and unattributed records together. When you want one of those alone, keep it in morbac.rules where the target is explicit:

    You wantWrite
    Every org and no-org records, no role neededglobal_rules
    Every org and no-org records, tied to a rolerules with scope = all
    Only records with no orgrules with scope = unattributed

    Reach for a global rule when the grant genuinely has no organizational boundary. A role-based rule keeps the grant revocable by role assignment, which is usually what you want.

    The canonical use is the bootstrap administrator: one row with user_id = <admin>, activity = NULL, view = NULL, modality permission grants everything, everywhere (recipe).

    The inverse works too: a targeted global prohibition bans a user from one view across every organization at once:

    INSERT INTO morbac.global_rules (user_id, activity, view, context_id, modality, priority)
    VALUES (:olivier, NULL, 'invoices',
            (SELECT id FROM morbac.contexts WHERE name = 'always'),
            'prohibition', 100);

    A global permission applies in every org of every tenant, and also to checks with no org at all. Grant wildcards only to real administrators; for anything narrower, scope the rule on activity or view.

    Global rules are evaluated at steps 3.5 (prohibitions) and 6.5 (permissions) of the decision algorithm, with the same priority semantics as every other store.

    For accounts that must never be blocked at all, see system principals.

    PreviousRules & ModalitiesNext System Principals
    pgmorbac - Multi-OrBAC permission engine for PostgreSQL
    DocumentationDownloadGitea