AccountedPro - Cascade and link guards
Two features connect a rule to the DocTypes it links to.
Cascade — push visibility onto linked documents
Propagation / Cascade on an Access Rule lets the rule's DocType (the parent) control access to a linked DocType (the child), matched by a link field on the child.
- Scope — Listed only (cascade to the target DocTypes you list) or All linked except listed.
- Each target is
<child DocType>via<link field on the child>in a mode.
The three modes differ on two questions — does the parent block the child? and does the parent grant the child?
| Mode | Person can't see the parent | Person can see the parent | Child's own doors still apply? |
|---|---|---|---|
| Gate | child is blocked | nothing granted — child's own rules decide | yes (parent is a prerequisite) |
| Grant | no effect | child is granted the same action | yes (added on top, OR) |
| Inherit | child is blocked | child gets the parent's exact access / tier | no (child access becomes the parent's) |
Read with an example — a rule on Workstation cascading to Production Label via its workstation field:
- Gate — “you may touch a Production Label only if you can see its Workstation.” Seeing the Workstation isn't enough (the label's own doors still decide), but not seeing it is a hard no. Use when the parent is a precondition.
- Grant — “if you can see the Workstation, you automatically get the same access to its Production Labels,” on top of whatever the label's own doors give. Never blocks. Use when the parent should also unlock the children.
- Inherit — “a Production Label's access is its Workstation's access” — same tier (read → read, discover-only → discover-only, none → none). Use when children are pure extensions of the parent.
Quick pick: parent required but not sufficient → Gate; parent access should also unlock children → Grant; children should exactly mirror the parent → Inherit.
A Gate gotcha worth knowing
A Gate matches on the link field. A child row whose link is empty / NULL (or points to a deleted parent) has nothing to gate through, so it is excluded — NULL IN (…) is never true in SQL. If you expect “orphan” children to be visible, either give them a parent or add a child-side door to cover the no-parent case. (Grant won't help there — it's additive and can't grant a child that has no parent.)
Link guards — block saving a link to a record you can't see
Link guards protect write paths. A guard says: when saving this DocType, if link field <field> points to a <DocType> record the person can't <read / …>, block the save.
Use it to stop someone attaching a record they aren't allowed to see — which would otherwise leak the linked name / existence, or let them wire up a document they can't access. Guards run in the validate hook, so they apply on Desk and REST / MCP writes alike.
Next: Access requests.