# Permission

URL: /business/nouns/permission · Id: `noun:permission`

> A Permission is what a Role may do: a Verb on a Noun within a scope, optionally bounded by a Limit.

A Permission is what a [Role](/business/nouns/role) may do: a [Verb](/business/nouns/verb) on a [Noun](/business/nouns/noun) within a scope, optionally bounded by a [Limit](/business/nouns/limit).

## Properties
| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `scope` | `string` | Yes | Where it applies, such as a Startup or a Tenant. |
| `limit` | [Limit](/business/nouns/limit) | No | The Limit that bounds it. |

## Object
```json
{
  "$id": "https://api.sb/ledgerlark.com/permissions/permission_1",
  "$type": "Permission",
  "scope": "Example scope",
  "limit": "limit_1"
}
```

## Relationships
- <a id="rel-allows"></a>A Permission **allows** one [Verb](/business/nouns/verb): each Permission allows one [Verb](/business/nouns/verb), within its scope and [Limit](/business/nouns/limit). `allows`, inverse [`allowedBy`](/business/nouns/verb#rel-allowed-by).
- <a id="rel-held-by"></a>A Permission **is held by** one [Role](/business/nouns/role): a [Role](/business/nouns/role)’s Permissions are what its [Worker](/business/nouns/worker) may do: [Verbs](/business/nouns/verb) on [Nouns](/business/nouns/noun) within a scope and a [Limit](/business/nouns/limit). `heldBy`, inverse [`holds`](/business/nouns/role#rel-holds).

## Verbs
| Verb | Description | Subject | Event | Class |
| --- | --- | --- | --- | --- |
| <a id="create"></a>[Permission.create](/business/nouns/permission/create) | Creates a Permission. Inherited from [Noun](/business/nouns/noun). | None. | `Permission.created` | Two-way: `try`, `send`, `do` |
| <a id="get"></a>[Permission.get](/business/nouns/permission/get) | Returns one Permission by id. Inherited from [Noun](/business/nouns/noun). | None. | None. | Read: `try`, `do` |
| <a id="list"></a>[Permission.list](/business/nouns/permission/list) | Returns Permissions, newest first, one page at a time. Inherited from [Noun](/business/nouns/noun). | None. | None. | Read: `try`, `do` |
| <a id="update"></a>[Permission.update](/business/nouns/permission/update) | Changes the given properties of a Permission. Inherited from [Noun](/business/nouns/noun). | None. | `Permission.updated` | Two-way: `try`, `send`, `do` |
| <a id="delete"></a>[Permission.delete](/business/nouns/permission/delete) | Deletes a Permission; its history is kept. Inherited from [Noun](/business/nouns/noun). | None. | `Permission.deleted` | One-way: `send`, `do` |

## Permissions
Which Access level may call each Verb. One-way Verbs wait their delay window.

| Operation | `owner` | `admin` | `member` | `viewer` |
| --- | --- | --- | --- | --- |
| `Permission.create` | Yes | Yes | No | No |
| `Permission.get` | Yes | Yes | Yes | Yes |
| `Permission.list` | Yes | Yes | Yes | Yes |
| `Permission.update` | Yes | Yes | No | No |
| `Permission.delete` | Yes | Yes | No | No |

## Call it

**Ask**

```text
Add a permission to PatentPad.
```

**API**

```bash
curl -X POST https://api.sb/patentpad.com/permissions \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"scope":"Example scope"}'
```

```json
{
  "api": "https://api.sb/patentpad.com",
  "permission": {
    "$id": "https://api.sb/patentpad.com/permissions/permission_1",
    "$type": "Permission",
    "scope": "Example scope"
  },
  "action": {
    "$id": "https://api.sb/patentpad.com/actions/action_1",
    "operation": "Permission.create",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/patentpad.com/actions/action_1"
  }
}
```

**SDK**

```ts
import { $ } from 'startup-builder'

const permission = await $.Permission.create({ scope: 'Example scope' })
```

**CLI**

```bash
npx startup-builder do Permission.create --json '{"scope":"Example scope"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Permission.create({ scope: 'Example scope' })"
  }
}
```

## Example
The [Billing Specialist](/agents/finance/billing-specialist) Role holds a Permission to `refund` on [Order](/business/nouns/order), within a $100 Limit.