PermissionEffect
: string
in package
Whether a grant permits an action or refuses it (B1, deny-override). # Precedence Default deny -> an [`PermissionEffect::Allow`] grant permits -> a [`PermissionEffect::Deny`] grant refuses, **and beats every allow**, wherever either sits in the resource hierarchy. Deny wins; there is no most-specific-wins tie-break. That choice is deliberate and is argued in full in `claude_dev/deny-override-design.md` §2.1. The short version: deny-override buys one checkable property — **adding a deny rule can never widen access, and can never be undone by adding allows** — and most-specific-wins buys expressiveness at the cost of making "is X denied?" unanswerable without enumerating every other rule that might out-specify it.
[PermissionEffect::Allow] is the default, so data written before this existed, and clients
that send no effect, both mean "allow". No migration.
An open enum. A value this SDK's copy of the spec does not list decodes to
self::Unknown rather than failing the response it arrived in (CONTRACT.md §27.11 rule 1).
Its own wire spelling is the empty string, which no server value is, so carrying an
unrecognised value back into an update is refused by the server rather than written as a
spelling it never used. A match over these cases needs an Unknown arm.
Table of Contents
Cases
- Allow = 'allow'
- The wire value `allow`.
- Deny = 'deny'
- The wire value `deny`.
- Unknown = ''
- A value this SDK's copy of the spec does not list; see the type's summary.
Methods
- fromWire() : self
- Parses a wire value into a PermissionEffect, mapping an unrecognised one to {@see self::Unknown}.
- toWire() : string
- The wire spelling of this case, for a request body.
Cases
Allow
The wire value `allow`.
Deny
The wire value `deny`.
Unknown
A value this SDK's copy of the spec does not list; see the type's summary.
Methods
fromWire()
Parses a wire value into a PermissionEffect, mapping an unrecognised one to {@see self::Unknown}.
public
static fromWire(string $value) : self
Never throws. A parse error here would fail the whole response the value arrived in, so
one unrecognised field of one record would take down the page it was on (§27.11 rule 1).
A match over this enum needs an Unknown arm.
Parameters
- $value : string
Return values
selftoWire()
The wire spelling of this case, for a request body.
public
toWire() : string
self::Unknown has none: it stands for a value this SDK never saw, and sending it
back as the empty string would leave the refusal to the server. It raises a ValidationError here instead, before any request is made
(CONTRACT.md §34.2 P12.2(a)). Use ->value to render for a log line.