Authorizations

This is a brief review of the DSpace authorization model as described in the functional overview and business logic layer documentation.

• If not explicitly stated the policy is DENY
• ADD/REMOVE policies are defined on containers and influence the content. ITEM is a container for BUNDLES, thus adding ADD/REMOVE policy on ITEM means the GROUP can add/remove bundles. BUNDLE is container for BITSTREAMS.
• READ/WRITE policies influence the objects themselves. READ on ITEM means view item, WRITE on ITEM means modify the ITEM (if you want to REMOVE the ITEM or ADD a new ITEM you need ADD/REMOVE on COLLECTION (see the point above))
• Policies are not transitive
• Policies are inherited on create
• Policies updates do not propagate
• There are hacks outside of this policy framework to allow submitters edit the metadata

Managing Policies via the REST API

In DSpace 7 resource policies can also be managed through the REST API at /api/authz/resourcepolicies. The endpoint supports:

• GET /api/authz/resourcepolicies/{id} – read a single policy
• POST /api/authz/resourcepolicies – create a new policy
• DELETE /api/authz/resourcepolicies/{id} – remove a policy
• PATCH – update policy properties (start/end date, name, etc.)
• Search by resource UUID, EPerson, Group, or embargo date

All operations require appropriate ADMIN permissions — meaning you must be a Site Administrator (global), or an Administrator of the Collection or Community that owns the resource. Regular submitters and collection readers cannot create or modify resource policies. See the REST API contract for full details.

Scenarios

The examples below illustrate how to configure authorizations for common use cases. They are not policy recommendations — the appropriate configuration depends on your institutional requirements.

Adding files

1. Submission without files, allow the submitter to add files later:

   • Empty submission doesn't contain bundles. You need to allow ADD on ITEM. This will be inherited by the bundle that was automatically created, the bitstream appears in this new bundle.
   • Step-by-step: authenticate to an admin account, navigate to the item page, open Edit item → Authorizations and add a new Item policy.

2. Submission with files, allow the submitter to add more:

   • There is a bundle called ORIGINAL, you need to allow ADD on this bundle.

Removing files

1. Submission without files, allow the submitter to add + remove files later:

   • As in adding files 1. you need to allow ADD/REMOVE on ITEM and this will be inherited.

2. Submission with files:

   • Again you need to allow REMOVE on ORIGINAL bundle. Adding REMOVE to ITEM at this point is not enough as the policy is not transitive and the update will not propagate.