User sharing control
- Type
- user_sharing
- Category
- Sharing
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, on a membership change or background sweep (lifecycle), or after a denial (record only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegrationDevice
- EnforcementEnforcement modes this type accepts. Enforce applies the row. Require approval (user sharing only) opens an admin approval inbox instead of blocking.
- EnforceRequire approval
- DefaultWhat happens when no row of this type is configured.
- Not configured — non-admins may share access freely.
Controls sharing performed through OpenApp: adding vendor-directory users (for example PalGate gate users) and related invitation flows. OpenApp cannot gate sharing done directly in a vendor app, but it can still surface unmanaged vendor-side users. When mode is approval_required, a pending request is opened for an admin to approve or deny.
When it is enforced
Evaluated when someone creates or updates an invitation, hold, or share. Requests that would exceed the limit are rejected — they are not silently rewritten.
Where to set it
Settings → Policies (org), the integration Policies tab, or — on PalGate — the device steward Policies tab.
Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.
Arguments
The config object on create/update. Row fields outsideconfig are enforcement (this type acceptsenforce or require_approval; any other value is rejected with 400), enabled (disabled rows never apply), and capability.
| Name | Type | Required | Values | Description |
|---|---|---|---|---|
| mode | string | Yes | noneadmin_onlyapproval_requiredall | none: nobody may share through OpenApp (including org admins). admin_only: only org admins. approval_required: non-admins need admin approval. all: sharing is allowed. |
How overlapping rows combine
Most-restrictive lattice: none > admin_only > approval_required > all. Compose with invite_creator_roles and no_transitive_delegation — every applicable guard must pass; none still wins.
Example
A non-admin who shares a gate user creates a pending approval instead of writing immediately. An admin reviews the request in the policy approval inbox.
{ "mode": "approval_required"}Integrations
This type is documented on these connectors:
- Home Assistant (home_assistant)
- KNX (knx)
- MQTT (mqtt)
- PalGate Cloud (palgate_cloud)
- Shelly Cloud (shelly_cloud)
- Shelly Websocket (shelly_websocket)
- Tasmota (tasmota)
- Virtual Access (virtual_access)
- Virtual Demo Devices (virtual_demo)
- Waveshare (waveshare)
Related
- Policy catalog
- Policies architecture guide
- Who may invite (invite_creator_roles)
- No transitive delegation (no_transitive_delegation)
- No invitation re-share (invitation_no_reshare)