# Access Control

> Source: `src/content/docs/actors/access-control.mdx`
> Canonical URL: https://rivet.dev/docs/actors/access-control
> Description: Authorize actions, queue publishes, and event subscriptions with explicit hooks.

---
Use access control to decide what authenticated clients are allowed to do.

This is authorization, not authentication:

- Use [authentication](/docs/actors/authentication) to identify who is calling.
- Use access-control rules to decide what they can do after connecting.

## Permission Surfaces

RivetKit authorization is explicit per surface:

- `onBeforeConnect` rejects unauthenticated or malformed connections.
- Action handlers (`actions.*`) enforce action permissions.
- `queues.<name>.canPublish` allows or denies inbound queue publishes.
- `events.<name>.canSubscribe` allows or denies event subscriptions.

## Fail By Default

Use deny-by-default rules everywhere:

1. Keep `onBeforeConnect` strict and reject invalid credentials.
2. In each action, explicitly allow expected roles and throw `forbidden` otherwise.
3. In `canPublish` and `canSubscribe`, return `true` only for allowed roles and end with `return false`.

## Return Value Contract

`canPublish` and `canSubscribe` must return a boolean:

- `true`: allow
- `false`: deny with `forbidden`

Returning `undefined`, `null`, or any non-boolean throws an internal error.

## Notes

- `canPublish` only applies to queue names defined in `queues`.
- Incoming queue messages for undefined queues are ignored and the publish succeeds as completed.
- `canSubscribe` only applies to event names defined in `events`.
- Broadcasting an event not defined in `events` still publishes to subscribers.

_Source doc path: /docs/actors/access-control_