Premium

Permissions & field-level policies

Control which workflow actions and event fields an actor may change. Declarative policies provide consistent client-side behavior and explainable decisions before the engine accepts a mutation.

What you configure

permissionPolicies: Match actions, actors, roles, states, fields, and an optional predicate.
defaultPermission: Choose the fallback decision; the default is deny.
permissionDecision: Inspect a proposed action and changed-field set for an actor.

Integration code example

Define the actor and role vocabulary used by your application.
Describe allowed actions and sensitive fields, then test both allowed and denied paths.
Mirror authoritative authentication, policy, transition, and version checks in your backend.

Copy this TypeScript into your application, not the browser console. Replace YOUR_WTS_LICENSE_KEY with an entitlement issued for your deployment origin. A WTS license is not a Google, Microsoft or CalDAV credential. These examples are documentation only and never execute on this page.

npm install @wts-calendar/core

import { verifyCalendarLicense } from '@wts-calendar/core';
import { EnterpriseCalendarWorkflow } from '@wts-calendar/core/enterprise-workflow';

const license = await verifyCalendarLicense('YOUR_WTS_LICENSE_KEY');
const workflow = new EnterpriseCalendarWorkflow({
  license,
  actor: { id: 'editor-1', roles: ['editor'] },
  online: false,
  autoFlush: false,
  events: [
    {
      id: 'release',
      title: 'Release window',
      start: '2026-09-07T09:00:00Z',
      end: '2026-09-07T10:00:00Z',
    },
  ],
  defaultPermission: 'deny',
  permissionPolicies: [
    {
      id: 'editor-update',
      effect: 'allow',
      actions: ['update', 'flush'],
      roles: ['editor'],
    },
    {
      id: 'protect-resource',
      effect: 'deny',
      actions: ['update'],
      roles: ['editor'],
      fields: ['resourceId'],
    },
    {
      id: 'manager-update',
      effect: 'allow',
      actions: ['update', 'flush'],
      roles: ['manager'],
    },
  ],
});

const event = workflow.getEvent('release')?.event;
export const canEditTitle = workflow.permissionDecision('update', event, ['title']);
export const canEditResource = workflow.permissionDecision('update', event, [
  'resourceId',
]);
// Use decisions to disable fields; submit also enforces the same runtime policies.
await workflow.submit({
  type: 'update',
  eventId: 'release',
  changes: { title: 'New title' },
});

Application responsibilities

This sample is runtime-only and initially offline. No database or WTS backend is required. Without your own backend adapter, flush commits only in memory and reload loses the state.

Actor IDs and roles are sample data, not authentication. A shared backend must authenticate users and independently enforce permissions, approval stages and event versions.

Behavior and lifecycle

Deny policies take precedence over allow policies.
Field rules can restrict a resource reassignment while allowing another event field to be edited.

Limits and responsibilities

These policies govern the workflow engine, not every possible direct write to application data.
Browser permissions are a user-experience boundary, not a replacement for server authorization.

Premium

Enable this capability

Optional module: @wts-calendar/core/enterprise-workflow
Signed entitlement: enterprise-workflow

Request the required features and deployment origins by email. Pricing and terms are confirmed privately. A WTS license is separate from provider credentials; do not send passwords or production access tokens.

Email for a license key →

This public guide does not execute Premium modules or collect license tokens.