# Access control in CloudBehaviours

> Restrict which callers are allowed to invoke a CloudBehaviour endpoint.

> **Important:**
>
> This page describes an experimental feature that might change significantly before release. It's not recommended to use or rely on experimental features in production environments due to potential instability.

Every CloudBehaviour endpoint has an access level. By default, Cloud Code resolves it from the class's `[StateScope]`: a `Scope.Player` class defaults to `Access.Player`, and a `Scope.MultiplayerSession` class defaults to `Access.SessionMember`. Add `[CloudCodeAccess]` only where a specific endpoint needs to differ from that default:

```csharp title="Overriding the default access level"
[StateScope(Scope.MultiplayerSession)]
public class MatchState : CloudBehaviour
{
    public void SubmitMove(string move) { }                   // Access.SessionMember (default)

    [CloudCodeAccess(Access.SessionHost)]
    public void StartMatch() { }                               // Only the session host

    [CloudCodeAccess(Access.Service)]
    public void GrantReward(string playerId, int amount) { }   // Only service-token callers
}
```

## The Access enum

Which values are valid depends on the class's `[StateScope]`:

| Value           | Valid on                        | Who can call                                                                                                                                        |
| :-------------- | :------------------------------ | :-------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Unspecified`   | Any scope                       | Resolves from the class scope at load time (the default): `Access.Player` for `Scope.Player`, `Access.SessionMember` for `Scope.MultiplayerSession` |
| `Global`        | Any scope                       | Any authenticated caller                                                                                                                            |
| `Service`       | Any scope                       | Non-player callers only, such as other CloudBehaviours, service accounts, or trusted backends. Never a player.                                      |
| `Player`        | `Scope.Player` only             | The player who owns the scope, and any non-player caller                                                                                            |
| `SessionMember` | `Scope.MultiplayerSession` only | Any member of the session, and any non-player caller                                                                                                |
| `SessionHost`   | `Scope.MultiplayerSession` only | The host of the session, and any non-player caller                                                                                                  |

An `Access` value that a class's scope can't support throws when the module loads.

## Choose a level

Use `Access.Service` on anything that mints value, such as granting currency or awarding items. Use `SessionHost` for match flow control, such as starting or force-advancing a match, where one client is authoritative. Beyond those cases, the scope's default access level is usually correct.

> **Important:**
>
> Access control restricts who can call an endpoint, but not who receives the changes the endpoint makes. When any endpoint changes synchronized state, the new state reaches every client in the scope. For example, clients can't call an `Access.Service` endpoint, but they still receive the synchronized state that the endpoint changes. To keep data private, use a private field, or refer to [Per-player state views in CloudBehaviours](/cloud-code/cloudbehaviours/per-player-state-views.md).

## Additional resources

* [Multiplayer game security in CloudBehaviours](/cloud-code/cloudbehaviours/secure-multiplayer-game-logic.md)
* [Timers in CloudBehaviours](/cloud-code/cloudbehaviours/timers.md)
* [Cross-behaviour calls in CloudBehaviours](/cloud-code/cloudbehaviours/calling-another-behaviour.md)