---
title: "Payload CMS — Globals Access Control"
aliases: [payload-globals-access, payload-cms-globals-permissions]
tags: [payload-cms, access-control, globals, cms, typescript, nextjs]
sources: [raw/access-control__globals.md]
created: 2026-05-15
updated: 2026-05-15
---

# Payload CMS — Globals Access Control

Global-level access control in Payload CMS restricts who can read or update [Global](https://payloadcms.com/docs/configuration/globals) documents and what they see in the Admin Panel.

See also: [[wiki/tech-patterns/payload-cms-collection-access-control|Collection Access Control]], [[wiki/tech-patterns/payload-cms-field-access-control|Field-Level Access Control]], [[wiki/tech-patterns/payload-cms-installation|Payload CMS Installation]].

## Config Location

Access is defined in the `access` property of a `GlobalConfig`:

```ts
import type { GlobalConfig } from 'payload'

export const Header: GlobalConfig = {
  slug: 'header',
  access: {
    read:         ({ req: { user } }) => Boolean(user),
    update:       ({ req: { user }, data }) => Boolean(user),
    readVersions: ({ req: { user } }) => Boolean(user), // versions only
  },
}
```

## Available Functions

| Function | Operation | Args |
|----------|-----------|------|
| `read` | `findOne` | `req` |
| `update` | `update` | `req`, `data` |
| `readVersions` | version history read | `req` |

- **`readVersions`** only available when `versions: true` is set on the Global.
- All functions receive `req` containing the authenticated `user`.
- `update` additionally receives `data` — the incoming payload.

## Return Values

- **`boolean`** — allow or deny outright.
- **Query constraint** — limit access based on document properties (row-level).
  - For `readVersions`: the constraint applies to the `versions` collection, **not** the original Global document.

## Patterns

### Authenticated-only read

```ts
read: ({ req: { user } }) => Boolean(user)
```

### Role-based update

```ts
update: ({ req: { user } }) => user?.role === 'admin'
```

### Public read, authenticated update

```ts
access: {
  read:   () => true,
  update: ({ req: { user } }) => Boolean(user),
}
```

## Key Takeaways

- Globals have **two base operations**: `read` and `update` (vs. collections which also have `create`/`delete`).
- Add `readVersions` only when `versions` is enabled — otherwise it's ignored.
- Query constraints in `readVersions` target the **versions collection**, not the Global itself — can produce unexpected results if misused.
- Admin Panel visibility is automatically restricted when `read` denies access.
- No field-level granularity here — use [[wiki/tech-patterns/payload-cms-field-access-control|Field-Level Access Control]] for per-field restrictions.

## Sources

- [Payload CMS Docs — Globals Access Control](https://payloadcms.com/docs/access-control/globals)
- Raw file: `raw/access-control__globals.md`
