# Passport access rules

Decide who sees which passport field: the six ESPR access tiers shipped by default, and the custom rules a brand adds field by field.

Source: https://docs.sealtrust.io/en/console/dpp-regles-acces/

---

The European regulation does not give the same passport to everyone. This screen shows the table shipped by the platform, which files every field path under an access tier, and lets you override it brand by brand.

![Table of default ESPR access tiers and custom rules per brand](/console/dpp-regles-acces.en.webp)

## What the screen shows

- A DPP access rules header, a subtitle about managing ESPR access tiers and custom rules per brand, a refresh button and a new rule button.
- A card to seed the default values for a brand, with a brand selector and a seed button.
- A default ESPR access tiers card: a two column table, field path and access tier, the tier shown as a coloured badge.
- A custom rules per brand card: a table of ID, brand, field path, access tier, product group, actions. A rule with no brand is shown as global.
- A creation or edit window with four fields: brand, field path with the example `materials.composition`, access tier as a dropdown, and product group, optional.

The dropdown offers exactly six tiers, the ones the server accepts: `public`, `end_user`, `repairer`, `recycler`, `upstream`, `authority`. By default the `authority` tier gets the pattern `*`, meaning every field of the passport.

> ⚠️ These six values are not ordered from narrowest to widest. `repairer`,
> `recycler` and `upstream` are three distinct audiences: each one adds, to the
> consumer baseline, what its own trade requires, and none of them contains
> another's fields. An accredited recycler therefore does not read the bill of
> materials reserved for the repairer, and holding one accreditation opens none
> of the others. Only `authority` receives the entire set.

## What you can do here

- Seed the default ESPR rules for a brand in one go. The operation is repeatable: nothing is deleted, only the missing rules are added, and the answer states how many were created and how many already existed.
- Create a custom rule by choosing a field path and one of the six tiers.
- Edit an existing rule. The brand of a rule cannot be changed here, it is never sent back to the server.
- Delete a rule with the bin icon.
- Refresh the two tables in one click.

## What governs access

The tab sits behind the DPP workspace profile guard, which excludes the `basic` brand profile. The seed button stays disabled until a brand is chosen, and the save button of the window until the field path is filled. A product group left empty is sent with the value `general`, never with a null value.

The custom rules list comes back in pages of 50, sorted by access tier then by field path. For an administrator attached to a single brand, the brand selector is locked and pre-filled.

## What the screen refuses

- An access tier outside the six allowed values is refused at validation, and the message lists the six values.
- An empty field path is refused: "field_path must not be empty".
- Creating a rule or seeding the defaults on a brand outside your scope is refused: "Access denied for this brand".
- A rule that does not exist or is out of scope is refused: "Access rule not found".
- The bin icon deletes the rule immediately, with no confirmation window.