Operations and Selectors

Every unit of authority in GoodMem is a rule: one operation paired with one selector. Rules appear in three places — direct grants, the capabilities of built-in roles, and the permission ceilings of scoped API keys. This page catalogs the operations and selectors and the syntax for writing rules. For how the pieces combine into an authorization decision, see Roles, Grants, and Selectors.

Selectors

DIRECT_MEMBERS_OF covers a container's members without covering the container itself. A rule on the direct members of space Y says nothing about Y, about another space's memories, or about resources Y merely references, such as its embedders.

Operations

Operation numbers are stable identifiers shared by the API, the database, and the server implementation. The resource kind is what the operation acts on: an EXACT rule names one resource of that kind, and a DIRECT_MEMBERS_OF rule names a container whose direct members are of that kind.

Users

MANAGE_USER_ENROLLMENT targets the user being enrolled. It can be granted only to a concrete principal, with the ANY or EXACT selector, and an EXACT grant must name a USER resource. Completing an enrollment is authenticated by the enrollment credential itself and does not evaluate this operation.

Service Identities

Spaces

API Keys

Embedders

Rerankers

LLMs

The READ_*_CREDENTIALS operations are separate from the ordinary READ_* operations. Reading a provider's configuration does not reveal its stored credentials, and direct grants cannot confer credential-read authority.

Inference

Memories

There is no UPDATE_MEMORY; a memory is deleted and recreated. LIST_MEMORY targets the space whose collection is searched, so an EXACT rule for it names a space. Semantic retrieval requires both LIST_MEMORY on each requested space and READ_MEMORY on the returned memories.

Extensions

Instance and Ownership

The two transfer operations cannot appear in direct grants. Transfer authority comes from current ownership, from instance ownership, or — for ordinary resources — from the instance ADMIN role.

Server Administration

RetrieveMemory Log Policies

See RetrieveMemory Query Logging for the policy model.

Access Administration

The protected target is the resource whose policy changes rather than a grant or role-assignment row. Like MANAGE_USER_ENROLLMENT, this operation can be granted only to a concrete principal with the ANY or EXACT selector.

Rule Syntax

The CLI flags that accept whole rules — --ceiling on goodmem apikey create and --grant on goodmem service-identity onboard — use one colon-delimited grammar:

OPERATION:SELECTOR[:RESOURCE_KIND[:RESOURCE_UUID]]

• ANY and OWN rules take exactly two segments. Adding a resource kind or UUID is an error.
• EXACT and DIRECT_MEMBERS_OF rules require a resource-kind segment. The kind INSTANCE forbids a UUID segment; every other kind requires one.
• Tokens are case-insensitive and accept kebab-case or underscores. The long enum prefixes (ACCESS_POLICY_OPERATION_, ACCESS_POLICY_SELECTOR_, ACCESS_POLICY_RESOURCE_KIND_) are optional. MEMORY_SPACE is accepted as an alias for SPACE.

Valid resource-kind tokens: INSTANCE, USER, SERVICE_IDENTITY, SPACE, API_KEY, EMBEDDER, RERANKER, LLM, MEMORY, EXTENSION, RETRIEVE_MEMORY_LOG_POLICY.

Examples:

READ_SPACE:ANY
CREATE_API_KEY:OWN
READ_SPACE:EXACT:SPACE:70e025f6-76ca-4cbe-b8fc-7dab8e84590a
READ_MEMORY:DIRECT_MEMBERS_OF:SPACE:70e025f6-76ca-4cbe-b8fc-7dab8e84590a
LIST_SPACE:EXACT:INSTANCE

The goodmem access-policy grant create and role-assignment assign commands take the same vocabulary as separate --operation, --selector, --resource-kind, and --resource-id flags.

Grant creation enforces a few shape rules on the server:

• Grants to the all-authenticated audience require EXACT or DIRECT_MEMBERS_OF.
• Direct grants cannot confer credential-read (READ_*_CREDENTIALS) or ownership-transfer authority.
• MANAGE_ACCESS and MANAGE_USER_ENROLLMENT grants require a concrete principal audience and the ANY or EXACT selector.

Role capabilities are fixed in code; the per-role rule lists are in Built-in Roles.