# Acl

Restrict calling a class method using an acl. Arguments are declared in pairs of a check type and an option object. When multiple pairs are declared, the caller is permitted access if passing *any* of the criteria. A `script.accessDenied.acl` `Fault` is thrown if all checks fail. To create an *and* style check, stack multiple `@acl` decorators.

```javascript
class Secured {

  // allows any administrator or account holder with matching email addresses.
  // service account emails take the form `${serviceAccount.name}@${org.code}-iam.serviceaccount.medable.com`
  @acl(
    'role', consts.roles.Administrator, 
    'account', ['admin@medable.com', 'sample@$env123-iam.serviceaccount.medable.com']
  )
  foo() {    
  }

  // fails unless the first argument equals a particular value and the method caller is test@medable.com
  @acl('assert', (principal, arg1) => arg1 === 'knock knock' && principal.email === 'test@medable.com' )
  bar(arg1, arg2) {  
  }

}
```

## @acl( type, options, ... )

*Arguments*

* `type` { String } Options object. One of (account, role, assert).
* `options` { \* }
  * For `account` { String\[] | ObjectID\[] } An account id or email list that's allowed access.
  * For `role` { ObjectID\[] } A role identifier list.
  * For `assert` { Function } A function that takes the calling principal and the methods arguments and must return

    a "truey" value to allow access. (\`function(principal, arg1, args, ...) { return true })


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.medable.com/cortex-api/decorators/runtime-1/acl.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.