What to do when a permission cannot be resolved for a Session — either because no Role
could be attached to its identity, or because neither the node nor its namespace declares
any RolePermissions.
"allow" : grant every permission. This is what node-opcua has always done, and what
the vast majority of address spaces need, since almost no server declares
RolePermissions on its own nodes.
"deny" : grant nothing. Fail-closed, for products that drive access entirely from
declared policy. Expect to set DefaultRolePermissions on every namespace,
otherwise the address space becomes unreadable.
Note that this governs Sessions only. A SessionContext with no Session at all is an
in-process caller (SessionContext.defaultContext, PseudoSession) and stays permissive
whatever this is set to — see SessionContext.getPermissions.
What to do when a permission cannot be resolved for a Session — either because no Role could be attached to its identity, or because neither the node nor its namespace declares any RolePermissions.
"allow": grant every permission. This is what node-opcua has always done, and what the vast majority of address spaces need, since almost no server declares RolePermissions on its own nodes."deny": grant nothing. Fail-closed, for products that drive access entirely from declared policy. Expect to set DefaultRolePermissions on every namespace, otherwise the address space becomes unreadable.Note that this governs Sessions only. A SessionContext with no Session at all is an in-process caller (SessionContext.defaultContext, PseudoSession) and stays permissive whatever this is set to — see SessionContext.getPermissions.