The permission object schema (Yb5) now includes both allow and deny arrays: { permissions: { allow: ["Tool1", "Tool2"], // optional deny: ["Tool3", "Tool4"] // optional } } See this entry in the whole of v0.2.69 →