Emergency free egress
- Type
- emergency_free_egress
- Category
- Operational
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, on a membership change or background sweep (lifecycle), or after a denial (record only).
- Access-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- Org
- EnforcementEnforcement modes this type accepts. Enforce applies the row. Require approval (user sharing only) opens an admin approval inbox instead of blocking.
- Enforce
- DefaultWhat happens when no row of this type is configured.
- Not configured — ordinary denies still apply.
One of two policies that relax rather than restrict (with agent_group_write). When any enforcing row is active, curfew, quiet hours, lockdown, anti-tailgating cooldown, maintenance window, and hold-closed lockout do not deny switchable.open. OpenApp still does not act as a fire-alarm control unit, FACP door release, or listed escape-door system. Occupants must already have independent mechanical or listed local exit. Every application is audited as policy.emergency_free_egress.applied. Do not market this type as life-safety or fire unlock. The row is org-wide: `active` is its only config field, and `output`, `applies_to`, and a capability scope are rejected.
When it is enforced
Evaluated when someone opens a door or gate or triggers an entity action. If this policy applies, the open is denied even when roles and grants would otherwise allow it.
Where to set it
Settings → Policies (org).
Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.
Arguments
The config object on create/update. Row fields outsideconfig are enforcement (this type acceptsenforce; any other value is rejected with 400), enabled (disabled rows never apply), and capability.
| Name | Type | Required | Values | Description |
|---|---|---|---|---|
| active | boolean | No | — | When true, OpenApp will not deny inbound opens. When the field is present it must be a boolean; an enabled row without it is active. Default: true |
How overlapping rows combine
Boolean OR of active across applicable enforcing rows.
Example
A guest invitation can open during curfew because OpenApp is not denying inbound opens. Local panic hardware and fire-alarm release are unchanged.
{ "active": true}Integrations
This type is documented on these connectors:
- Home Assistant (home_assistant)
- KNX (knx)
- MQTT (mqtt)
- PalGate Cloud (palgate_cloud)
- Shelly Cloud (shelly_cloud)
- Shelly Websocket (shelly_websocket)
- Tasmota (tasmota)
- Virtual Access (virtual_access)
- Virtual Demo Devices (virtual_demo)
- Waveshare (waveshare)
Related
- Policy catalog
- Policies architecture guide
- Emergency lockdown (emergency_lockdown)
- Invitation curfew (invitation_curfew)
- Quiet hours (quiet_hours)