---
title: "Access control entitlement checks for LUSID data resources"
slug: "access-control-entitlement-checks-for-lusid-data-resources-1"
updated: 2025-04-04T15:21:44Z
published: 2025-04-04T15:21:44Z
canonical: "support.lusid.com/access-control-entitlement-checks-for-lusid-data-resources-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.lusid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access control entitlement checks for LUSID data resources

LUSID performs entitlement checks before a user can call any [LUSID API endpoint](https://www.lusid.com/docs/api/lusid/intro) and interact with the data resources it returns.

For much more information, [read our IAM documentation](/v1/docs/identity-management-and-access-control-iam). In summary, each LUSID user must have (at least one) feature policy and data policy:

- A feature policy controls access to API endpoints. This is irrespective of whether a user interacts with LUSID by calling the REST API directly, or indirectly via a proxy such as the SDK, the LUSID web app or Luminesce (since all proxies themselves call the REST API).
- A data policy controls access to data resources (such as [entities](/v1/docs/what-is-an-entity) and [properties](/v1/docs/properties)) returned by API endpoints.

To perform any real-world operation in LUSID, a user must be assigned both types of policy. This is because a feature policy without a corresponding data policy yields no data, and a data policy without a corresponding feature policy cannot perform operations. [Work through a tutorial](/v1/docs/setting-up-basic-access-control-for-different-lusid-users).

The attached file lists the data resource entitlement checks that LUSID performs for each API endpoint.

For example, consider a feature policy granting a user the right to call the [ListAllocations](https://www.lusid.com/docs/api/lusid/endpoints/allocations/ListAllocations/) API endpoint. In the corresponding data policy, you should include:

- The `Allocation` resource with the `Read` action to return `Allocation` entities.
- The `PropertyDefinition` and `PropertyValue` resources, both with the `Read` action, to return properties added to those entities, if any.

![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(668).png)

[](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/LUSIDAccessControlDataResourceEntitlementChecks(4).xlsx)LUSIDAccessControlDataResourceEntitlementChecks65.67 KB[](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/LUSIDAccessControlDataResourceEntitlementChecks(4).xlsx)