# Access configuration

WirePlumber includes a "client access" policy which defines access control rules for PipeWire clients.

## Rules

This policy can be configured with rules that can be used to match clients and apply default permissions to them.

Example:

    access.rules = [
      {
        matches = [
          {
            access = "flatpak"
            media.category = "Manager"
          }
        ]
        actions = {
          update-props = {
            access = "flatpak-manager"
            default_permissions = "all",
          }
        }
      }
      {
        matches = [
          {
            access = "flatpak"
          }
        ]
        actions = {
          update-props = {
            default_permissions = "rx"
          }
        }
      }
    ]

Possible permissions are any combination of:

> - `r`: client is allowed to read objects, i.e. "see" them on the registry and list their properties

> - `w`: client is allowed to write objects, i.e. call methods that modify their state

> - `x`: client is allowed to execute methods on objects; the `w` flag must also be present to call methods that modify the object

> - `m`: client is allowed to set metadata on objects

> - `l`: nodes of this client are allowed to link to other nodes that the client can't "see" (i.e. the client doesn't have `r` permission on them)

The special value `all` is also supported and it is synonym for `rwxm`