# Access contract

> can(), tenant_ids_with() and is_platform(): one permission contract for policies and SQL modules, over a roles list, a role and permission catalog, an authorization provider or the app's own functions (blocks.permissions.model).

- Category: Identity & access
- Module: `permissions`
- Modes: `managed`, `adopt`, `custom`
- Docs: https://bettersupabase.com/docs/blocks/permissions
- Page: https://bettersupabase.com/blocks/permissions

## Install

```bash
npx better-supabase add permissions
```

The command also installs `updated-at`, `memberships`.

## Configure

Add the block to `better-supabase.config.ts`:

```ts
import { defineConfig } from "better-supabase/config";

export default defineConfig({
  blocks: {
    // Required by permissions; add installs them too.
    "updated-at": {},
    memberships: {},
    // Modes: "managed", "adopt", "custom". The default is "managed".
    permissions: { mode: "managed" },
  },
});
```

## Client

The React hooks are in `better-supabase/blocks/permissions/react`. They return data and actions and render no UI. Source: https://github.com/ScaleDockHQ/better-supabase/blob/main/packages/better-supabase/src/blocks/permissions/react/index.ts

## Related blocks

Requires: [memberships](https://bettersupabase.com/blocks/memberships.md)

Works with: [invitations](https://bettersupabase.com/blocks/invitations.md), [organizations](https://bettersupabase.com/blocks/organizations.md), [memberships](https://bettersupabase.com/blocks/memberships.md)

## Recipes

- [Can](https://bettersupabase.com/recipes/can.md): Shows an action only to members who hold a permission key; the checks of one render share one round trip.