> For the complete documentation index, see [llms.txt](https://docs.api.intratool.de/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.api.intratool.de/introduction/entity-permissions.md).

# Entity Permissions

[Entity Permissions](/api-reference/entity-permissions.md) attach permission-key grants to a specific resource instance. A grant assigns a named operation to a [User](/api-reference/users.md), [Role](/api-reference/roles.md), or [Department](/api-reference/departments.md).

A resource that uses these grants lists the [Entity Permissions capability](/introduction/resource-capabilities/entity-permissions.md) in its Model Definition. The resource documentation defines its permission keys, direct or inherited mode, accepted request fields, and endpoint-specific effects.

## Grant Structure

Each Entity Permission contains:

* `key`: The resource-specific permission key.
* `permission_entity` and `permission_entity_id`: The user, role, or department receiving the grant.
* `target_entity` and `target_entity_id`: The resource instance controlled by the grant.

## Direct and Inherited Permissions

Direct Entity Permissions belong to the resource instance itself. A directly controlled resource can expose an `entityPermissions` relation and documented create or update endpoints can accept `entity_permissions`.

Inherited Entity Permissions are evaluated through a documented parent resource. A dependent resource does not own independent grants unless its Model Definition also declares direct Entity Permissions.

## Permission Enforcement

[Module Permissions](/api-reference/permissions.md) determine whether the authenticated user's role can use a module or operation. Entity Permissions then restrict access to individual resource instances. Ownership and administration rules can provide documented alternatives.

[Restricted Scope](/introduction/entity-permissions/restricted-scope.md) defines how direct and inherited Entity Permissions filter queries and authorize operations.

## Relationship to Targetables

[Targetables](/introduction/resource-capabilities/targetables.md) select users or departments as participants, recipients, or responsible parties. They do not grant permission keys. A resource can support either or both concepts, and its Model Definition documents their effects separately.