---
title: "What are a policy and a policy collection?"
slug: "what-are-a-policy-and-a-policy-collection"
updated: 2024-10-17T15:53:47Z
published: 2024-10-17T15:53:47Z
canonical: "support.lusid.com/what-are-a-policy-and-a-policy-collection"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.lusid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What are a policy and a policy collection?

A policy is a grant (or denial) of access to a particular feature or dataset within LUSID.

Each LUSID [user](/v1/docs/what-are-a-personal-user-and-a-service-user) must have at least one [role](/v1/docs/what-is-a-role), and each role must have at least one policy. For example, a user might have a policy that can be described as follows:

*Grant access to list all the portfolios in a particular scope, and thus to see transactions for those portfolios that have been added after a certain date.*

Or:

*Deny access to see quotes from a particular market data provider for certain instruments.*

A policy can be grouped in a [policy collection](/v1/docs/how-do-i-create-a-policy-collection) for logical convenience, and policy collections may themselves contain policy collections. [See how to assign policies, roles and users](/v1/docs/how-do-i-assign-policies-roles-and-users-to-each-other-using-the-api).

![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/8d08f4db-b719-4f1e-b21e-3cbbe9fdc6e1.png)

There are two aspects to a policy:

- *Features* control access to one or more API endpoints. Note a feature policy applies even to personal users using the LUSID graphical web app, since the web app itself calls the LUSID API. [See how to create a feature policy](/v1/docs/how-do-i-create-a-feature-policy).
- *Data* controls access to one or more entity datasets, for example to all the data belonging to portfolios or to quotes, and potentially to the properties decorated onto those entities (depending on your licence). Note a data policy can further restrict access to (for example) just a specific portfolio, or to just those [transactions added after](/v1/docs/how-do-i-specify-an-expiry-date-or-a-rolling-validity-date-for-a-policy) a certain date. [See how to create a data policy](/v1/docs/how-do-i-create-a-data-policy).

> [!NOTE]
> Note
> 
> To perform any real-world operation in LUSID, a user must have matching feature and data policies. This is because a data policy without an equivalent feature policy cannot perform operations, and a feature policy without an equivalent data policy yields no data.

Upon each access request, LUSID checks a user's policies [in a particular order](/v1/docs/understanding-how-lusids-identity-management-and-access-control-systems-work#access-control) to determine whether they have sufficient permissions. Note a user may have conflicting policies:

- If the user has conflicting policies in different roles, the role with the highest precedence takes effect. [See how to set role precedence](/v1/docs/how-do-i-create-a-role#setting-precedence-for-a-role).
- If a user has two policies in the same role that are identical except one allows access and the other denies it, the deny takes effect.

A [default set of policies](/v1/docs/what-default-roles-and-policies-are-provided-with-lusid) is provided with LUSID for you to adopt or adapt.