![\"aoothjs\"](\"https://aooth.moost.org/logo.svg\"){kind=logo}
\n \n\n \n \n \n
\n Batteries-included RBAC — re-exports @aooth/arbac-core and adds a fluent role builder, reusable privilege factories, scope-merge utilities, and a codegen CLI for typed resource/action unions.\n
\n Documentation →\n
\n\n---\n\n## Install\n\n```bash\npnpm add @aooth/arbac\n```\n\n## Documentation\n\nFull docs, API reference, and recipes: **https://aooth.moost.org/arbac/**\n\n- [Concepts](https://aooth.moost.org/arbac/concepts)\n- [Role builder](https://aooth.moost.org/arbac/builder)\n- [Privilege factories](https://aooth.moost.org/arbac/privileges)\n- [Scope merging](https://aooth.moost.org/arbac/scopes)\n- [Codegen CLI](https://aooth.moost.org/arbac/codegen)\n- [API reference](https://aooth.moost.org/api/arbac)\n\n## Deny is binary on (resource, action)\n\n`.deny(resource, action)` short-circuits the entire `(resource, action)` tuple — there is no scope or filter parameter. Once a deny rule's action regex matches, `evaluate()` returns `{ allowed: false }` immediately, before any other role's `allow` scopes are even constructed (see `arbac-core/src/arbac.ts:126-131`).\n\nIf you need \"hide rows where condition X\", express it as an `allow` with a filter that excludes X, not as a partial deny:\n\n```ts\n// ✗ Not supported — no row-level deny.\n// .deny(\"tasks\", \"query\", { scope: { filter: { status: \"secret\" } } })\n\n// ✓ Use a filtered allow instead.\nallowTableRead