---
title: Access Control Model
url: https://docs.kaltura.com/docs/rich-media-cms-apis/content-management/access-control-access-control-model
---

## Access Control Model


### Architecture

An access control profile (`KalturaAccessControlProfile`) contains an ordered array of rules (`KalturaRule`). Each rule has:

- **conditions** -- array of `KalturaCondition` objects (AND logic: ALL must be true)  
- **actions** -- array of `KalturaAccessControlAction` objects (what to enforce)  
- **contexts** -- array of `KalturaAccessControlContextTypeHolder` (when to evaluate: PLAY, DOWNLOAD, THUMBNAIL)  
- **message** -- message to return to the player when rule fires  
- **stopProcessing** -- if true and conditions met, skip remaining rules  

### Rule Evaluation Logic

1. Rules evaluate in array order  
2. Each rule evaluates only if its `contexts` match the current request context (PLAY for playManifest, DOWNLOAD for raw/download, THUMBNAIL for thumbnails). A rule with no contexts evaluates in all contexts.  
3. A rule is **fulfilled** when ALL its conditions evaluate to true (AND logic)  
4. When fulfilled, the rule's actions are added to the outcome and its message is added to the outcome messages  
5. If `stopProcessing` is true on a fulfilled rule, remaining rules are skipped  
6. All accumulated actions execute  
7. If no rule matches, content is allowed (default: allow)  

### Access Control Scope

When access control is evaluated, the server constructs a `KalturaAccessControlScope` from the request:

| Field | Type | Description |
|-------|------|-------------|
| `contexts` | array | Which contexts to test (no context = any context) |
| `ip` | string | Request IP address for geographic conditions |
| `ks` | string | Kaltura session for authentication/user conditions |
| `referrer` | string | Page URL for domain conditions |
| `time` | integer | Unix timestamp for scheduling (null = server time) |
| `userAgent` | string | Browser/client application for agent conditions |