Unexpected permission given

[benjick]

Hello!

I have this in my userAbility:

    can("create", "Group", {
      createdByUserId: user.userId,
      type: "TEACHING_GROUP",
    });

It works as expected when I provide createdByUserId and type, but when I call this: ability.can("create", "Group") I get true. I was expecting this to return false because the required params aren't provided. Is this working as expected?

[stalniy]

yes, it's by design. It's written in guide which nobody reads 😄

[benjick]

Thanks.. 🫣 I see it now