> For the complete documentation index, see [llms.txt](https://docs.api.intratool.de/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.api.intratool.de/introduction/entity-permissions/restricted-scope.md).

# Restricted Scope

Restricted Scope applies [Entity Permissions](/introduction/entity-permissions.md) to resource queries and individual operations. The affected resource documentation identifies the required permission key and any ownership or administration alternatives.

## Query Filtering

Permission filtering is endpoint-specific. List and show operations can return only accessible resources, while administration endpoints can use another permission key or apply documented privileged access. A grant for one operation does not imply access to another operation.

## Direct Access

Directly controlled resources evaluate their own Entity Permissions. They can expose an `entityPermissions` relation, and their Restricted Scope matches grants for the authenticated [User](/api-reference/users.md), [Role](/api-reference/roles.md), or accessible [Departments](/api-reference/departments.md).

## Inherited Access

Dependent resources can apply the Restricted Scope of a documented parent relation. The dependent resource does not necessarily expose or persist independent Entity Permissions.

## Permission Input

Documented create and update endpoints for directly controlled resources may accept `entity_permissions`. The value is an array of permission definitions; the endpoint derives the target resource from the resource being created or updated.

The following example grants the `view` key to two users:

```json
[
  {
    "key": "view",
    "permission_entity": "user",
    "permission_entity_id": 25
  },
  {
    "key": "view",
    "permission_entity": "user",
    "permission_entity_id": 26
  }
]
```

Only send `entity_permissions` where the endpoint's Request Keys document it. Supported permission keys and permission-entity types remain resource-specific.