permissions-expert

Frappe evaluates has_permission hooks to enforce custom access control by checking role permissions, User Permissions, and sharing rules before granting or denying access to a specific DocType record.

The Frappe permission evaluation order applies role-level checks first, then User Permissions, followed by custom hooks like has_permission, permission_query_conditions, write_permission_query_conditions, and has_website_permission to gate access securely.

You can restrict data visibility in multi-tenant scenarios by implementing permission_query_conditions to append SQL filters, ensuring users only query and view records that match their assigned User Permissions and tenant boundaries.

Yes, you can combine Frappe workflow transitions with role-based permissions to gate document state changes, ensuring users only interact with allowed workflow states based on their assigned roles and permission levels.

Frappe User Permissions might not override role permissions if custom has_permission logic bypasses standard checks, or if sharing rules and permlevels inadvertently grant broader access than intended.

The best way to audit Frappe permission logic is to trace the evaluation order across has_permission, permission_query_conditions, and workflow hooks, verifying access with test users to isolate conflicting rules and maintain robust security.