Wildcard Permission
A permission where the resource or action component is *, matching any value. For example, invoice:* grants all actions on invoices; *:read grants read on all resources.
A wildcard permission uses * as a placeholder that matches any value in the resource or action field of an access check.
Wildcard patterns
invoice:*— allows any action on the "invoice" resource*:read— allows read on any resource*:*— allows any action on any resource (superadmin)
Wildcard evaluation
Wildcards are expanded during evaluation. When checking invoice:delete, both an exact invoice:delete permission and a wildcard invoice:*permission are considered matches. Deny-wins semantics apply across all matching permissions.
// Create a superadmin role with wildcard permission
await createPermission(scopeId, {
id: 'superadmin-all',
resource: '*',
action: '*',
effect: 'allow',
})
await createRole(scopeId, {
id: 'superadmin',
name: 'Super Admin',
permissions: ['superadmin-all'],
})Wildcard + deny-wins
Wildcards and deny-wins work together to create flexible restriction policies. Grant broad wildcard access, then restrict specific operations with an explicit deny:
// Admin gets everything:
invoice:* → allow
// Except delete (GDPR compliance requirement):
invoice:delete → deny
// Result: invoice:create/read/update → allowed
// invoice:delete → DENIED (deny overrides wildcard allow)Related terms
Authorization that evaluates permissions at the individual resource or action level, rather than broadly by user type or role.
An authorization evaluation rule where an explicit deny on any matching permission overrides all allow permissions. Used to enforce least-privilege without restructuring role hierarchies.