Developer guide: authorization and scopes

Short answer: Every request passes one authorization chain: credential, client, workspace, organization policy, allowed addresses, environment, scope, owner (for writes) and the application's entitlement, then the application's own access rules for each record. Scopes are explicit, none is granted by default and none implies another.

Verified for PVology 0.61.0 · updated 2026-10-11