Allowed invitation contact kinds

Type

invitation_allowed_contact_kinds

Category

Invitations

Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, on a membership change or background sweep (lifecycle), or after a denial (record only).

Authoring-time

TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.

OrgIntegrationDevice

EnforcementEnforcement modes this type accepts. Enforce applies the row. Require approval (user sharing only) opens an admin approval inbox instead of blocking.

Enforce

DefaultWhat happens when no row of this type is configured.

Not configured — all four contact kinds are allowed.

Contacts may be free-form (an email address or a phone number) or drawn from the organization (a person or a group). This policy narrows the set. An operator who wants every invited person to already exist in the directory allows only user and group, which also means every invitation is attributable to a known identity. The set is intersected across rows, so a parent organization can only ever narrow further.

When it is enforced

Evaluated when someone creates or updates an invitation, hold, or share. Requests that would exceed the limit are rejected — they are not silently rewritten.

Where to set it

Settings → Policies (org), the integration Policies tab, or — on PalGate — the device steward Policies tab.

Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.

Arguments

The config object on create/update. Row fields outsideconfig are enforcement (this type acceptsenforce; any other value is rejected with 400), enabled (disabled rows never apply), and capability.

Name	Type	Required	Values	Description
kinds	string[]	No	usergroupemailphone	Contact kinds an invitation may name. When present it must be a non-empty array of known kinds. Omitting it is accepted but the row then restricts nothing — always set it.
applies_to	string[]	No	adminmemberresidentall	Principal kinds this row binds, as a non-empty array of admin, member, resident, all. Other kinds, a bare string, and empty arrays are rejected. `all` matches every kind this policy can bind. A caller is every kind it is at once, and a row binds when any of them is listed. When omitted, the default applies. Default: Every author, including admins.
output	string or integer	No	—	Device policies only. One output of the device, as the device reports it (PalGate `1` or `2`, a Shelly, Tasmota, or Waveshare channel index). When set, the policy binds only actions on that output; when omitted, every output of the device. An output that is not one of the device’s outputs, or `output` on an organization or integration policy, is rejected. If an action’s output cannot be identified, an output-scoped policy denies it.

How overlapping rows combine

Set intersection across applicable rows. A row without kinds restricts nothing.

Example

An invitation that names a bare phone number is rejected; the author must pick a person or group from the organization.

config

{
  "kinds": [
    "user",
    "group"
  ]
}

Integrations

This type is documented on these connectors:

• Home Assistant (home_assistant)
• KNX (knx)
• MQTT (mqtt)
• PalGate Cloud (palgate_cloud)
• Shelly Cloud (shelly_cloud)
• Shelly Websocket (shelly_websocket)
• Tasmota (tasmota)
• Virtual Access (virtual_access)
• Virtual Demo Devices (virtual_demo)
• Waveshare (waveshare)

Related

• Policy catalog
• Policies architecture guide
• Require named invitations (invitation_require_named_audience)
• Require invitation identity (invitation_require_identity)