Developer permissions overview

Each policy is parsed using Liquid, and the system checks them in order of their appearance in the key.

If the content of the policy evaluates to anything other than , the policy is considered violated, and the system will not proceed with executing the action (such as submitting a form or rendering a page).

Writing a policy that is safe

A policy must print true or false on every path through its code. Do not rely on a blank output being treated as a denial: write the deny path out as an explicit false, so a reviewer can see it and a test can check it. Check that the data a policy reads, such as context.current_user, is present before you read a property from it.

Pages declare their policies in front matter, and the policies run before any of the page's code. A failed check answers 403 by default, or sends the visitor to the page's redirect_to, optionally with a flash message.

In this section

• Adding an Authorization Policy
• Associating an Authorization Policy with a Page
• Associating an Authorization Policy with a Form
• Handling an Authorization Policy Violation