Control who can read and write Payload collections and globals

At a glanceCopy Anchor Link

• Who: Payload CMS developers who want role permissions declared as data.
• What: Turn a list of role grants into Payload access functions, default-deny, with no roles built in.
• Use when: When several roles share one Payload app and new collections must stay closed until someone grants them.
• Avoid when: For ownership, field-level or locale rules — write Payload access functions directly.

InstallCopy Anchor Link

pnpm add @zedtech/zedkit-payload-access

Latest: 0.1.0 (via changesets).

ExampleCopy Anchor Link

import { withGeneratedAccess, type Grant } from "@zedtech/zedkit-payload-access";
const grants: Grant[] = [{ role: "editor", resource: "collection", name: "posts", actions: ["read", "update"] }];
const posts = withGeneratedAccess({ slug: "posts", fields: [] }, grants);
// posts.access: editors read/update, everyone else denied
const anonymous = { anonymousRole: "guest" }; // optional: rename the signed-out role

Wraps: payload