Understanding Policies in ZenStack

Oct 13, 2025 by wbrum.org 135 views

Introduction

In ZenStack, policies are used to control access to data in your application. When defining a model, you can apply different policies to determine what actions are allowed or denied for specific users. However, you may encounter issues when trying to apply multiple policies at the same time. In this article, we will explore how to add multiple policies to a model in ZenStack and troubleshoot common issues.

Understanding Policies in ZenStack

Policies in ZenStack are defined using the @@deny and @@allow directives. These directives specify the actions that are allowed or denied for a particular user or group of users. For example, the following policy allows users to read data if they are active members of the model:

@@allow('read', members?[user == auth() && active])

Applying Multiple Policies

When you want to apply multiple policies to a model, you can simply add more @@deny and @@allow directives. However, as you've encountered, this may not always work as expected. Let's take a look at an example:

@@deny('all', auth() == null)
@@deny('create', true)
@@allow('read', members?[user == auth() && active])
@@allow('update,delete', members?[user == auth() && role == ADMIN && active])
@@allow('all', auth().role == SUPERADMIN)

In this example, we have four policies:

Deny all actions for users who are not logged in.
Deny creation of new data for all users.
Allow users to read data if they are active members of the model.
Allow users to update and delete data if they are active members of the model and have the ADMIN role.
Allow all actions for users who have the SUPERADMIN role.

Troubleshooting Issues

When applying multiple policies, you may encounter issues where only one policy is being applied. This can be due to the order in which the policies are evaluated. In ZenStack, policies are evaluated in the order they are defined. If a policy is denied, the subsequent policies are not evaluated.

In your case, the SUPERADMIN policy is not being applied because the previous policies are denying access to the data. To troubleshoot this issue, you can try the following:

Remove the @@deny('all', auth() == null) policy to see if the SUPERADMIN policy is applied.
Check the order in which the policies are defined. Make sure that the SUPERADMIN policy is defined after the policies that allow access to the data.
Use the prisma:info command to see the actual policy being applied. This can help you identify which policy is being ignored.

Example Use Case

Let's say you have a model called User and you want to apply the following policies:

Deny all actions for users who are not logged in.
Allow users to read data if they are active members of the model.
Allow users to update and delete data if they are active members of the model and have the ADMIN role.
Allow all actions for users who have the SUPERADMIN role.

You can define the policies as follows:

@@deny('all', auth() == null)
@@allow('read', members?[user == auth() && active])
@@allow('update,delete', members?[user == auth() && role == ADMIN && active])
@@allow('all', auth().role == SUPERADMIN)

Conclusion

Adding multiple policies to a model in ZenStack can be complex, but with the right approach, you can control access to your data with precision. By understanding how policies are evaluated and troubleshooting common issues, you can ensure that your policies are applied correctly. Remember to use the prisma:info command to see the actual policy being applied and adjust your policies accordingly.

Environment

ZenStack version: 2.7.4
Prisma version: 5.21.1
Database type: Postgresql

Additional Resources

ZenStack Documentation: Policies
Prisma Documentation: Policies
ZenStack Policies: Frequently Asked Questions =====================================================

Introduction

In our previous article, we explored how to add multiple policies to a model in ZenStack. However, we know that there are many more questions and concerns when it comes to implementing policies in ZenStack. In this article, we will answer some of the most frequently asked questions about ZenStack policies.

Q: What is the order of policy evaluation in ZenStack?

A: In ZenStack, policies are evaluated in the order they are defined. If a policy is denied, the subsequent policies are not evaluated. This means that the first policy that is denied will prevent the subsequent policies from being applied.

Q: How do I troubleshoot policy issues in ZenStack?

A: To troubleshoot policy issues in ZenStack, you can use the prisma:info command to see the actual policy being applied. This can help you identify which policy is being ignored. Additionally, you can try removing policies one by one to see which policy is causing the issue.

Q: Can I use multiple `@@deny` directives in a single policy?

A: Yes, you can use multiple @@deny directives in a single policy. However, be careful not to create a situation where a policy is denied multiple times, as this can lead to unexpected behavior.

Q: How do I allow access to a specific field in a model?

A: To allow access to a specific field in a model, you can use the @@allow directive with the fields option. For example:

@@allow('read', fields=['name', 'email'])

This will allow access to the name and email fields in the model.

Q: Can I use a custom condition in a policy?

A: Yes, you can use a custom condition in a policy by using the condition option. For example:

@@allow('read', condition='user.role == "admin"')

This will allow access to the model if the user has the admin role.

Q: How do I deny access to a specific field in a model?

A: To deny access to a specific field in a model, you can use the @@deny directive with the fields option. For example:

@@deny('read', fields=['password'])

This will deny access to the password field in the model.

Q: Can I use a policy to deny access to a specific action?

A: Yes, you can use a policy to deny access to a specific action by using the action option. For example:

@@deny('create', action='create')

This will deny access to the create action in the model.

Q: How do I allow access to a specific action in a model?

A: To allow access to a specific action in a model, you can use the @@allow directive with the action option. For example:

@@allow('create', action='create')

This will allow access to the create action in the model.

Q: Can I use a policy to allow access to a specific model?

A: Yes, you can use a policy to allow access to a specific model by using the model option. For example:

@@allow('read', model='User')

This will allow access to the User model.

Q: How do I deny access to a specific model?

A: To deny access to a specific model, you can use the @@deny directive with the model option. For example:

@@deny('read', model='User')

This will deny access to the User model.

Conclusion

In this article, we answered some of the most frequently asked questions about ZenStack policies. We hope that this information has been helpful in understanding how to implement policies in ZenStack. If you have any further questions or concerns, please don't hesitate to contact us.