> For the complete documentation index, see [llms.txt](https://docs.api.intratool.de/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.api.intratool.de/introduction/resource-capabilities/entity-permissions.md).

# Entity Permissions

The Entity Permissions capability identifies resources whose access can depend on permission-key grants for individual resource instances. Grants can address a [User](/api-reference/users.md), [Role](/api-reference/roles.md), or [Department](/api-reference/departments.md); supported keys and their endpoint-specific effects remain resource-specific.

## Direct Entity Permissions

A directly controlled resource owns its Entity Permissions. Its Model Definition states whether it exposes an `entityPermissions` relation, and its endpoints state whether they accept `entity_permissions` or apply a Restricted Scope.

## Inherited Entity Permissions

A dependent resource can derive effective Entity Permissions from a documented parent resource. It does not accept or persist independent grants unless its own Model Definition also declares direct Entity Permissions.

## Restricted Scope

The [Restricted Scope](/introduction/entity-permissions/restricted-scope.md) applies direct or inherited Entity Permissions to queries and operations. Administration, ownership, and other alternatives remain endpoint-specific.

## Relationship to Targetables

Entity Permissions grant named operations on a resource instance. [Targetables](/introduction/resource-capabilities/targetables.md) select users or departments without creating permission-key grants.

The [Entity Permissions introduction](/introduction/entity-permissions.md) defines the shared grant structure and enforcement model.