These docs are under active development and cover the v0.20 Kobicha security model.
Peios Learn
On this page
§7.4

Restricted Tokens

A restricted token carries a secondary SID list -- the restricting SIDs. When AccessCheck encounters a restricted token, it evaluates the DACL twice:

  1. Normal pass. The DACL is evaluated against the token's normal identity (user SID, group SIDs). This is the standard evaluation.

  2. Restricted pass. The same DACL is evaluated again, but SID matching uses only the restricting SID list. The token's normal groups are invisible.

Access is granted only for rights that both passes agree on -- the intersection. The restricting SID list acts as a filter: the principal can never receive more access than the restricting SIDs would independently permit.

§7.4.1 Write-restricted tokens

A variant where the intersection applies only to write-category bits. Read and execute access comes from the normal pass alone. What constitutes "write" is defined by the object type's GenericMapping: the bits that GENERIC_WRITE maps to are subject to the restricted check.

§7.4.2 Privileges bypass the restricted pass

Rights granted by privileges are added back after the intersection. Privileges are system-level grants from security policy, not from the object's DACL. Token restriction reduces the token's identity-based access surface; privilege-based grants are orthogonal.

§7.4.3 Owner implicit rights in the restricted pass

The restricted pass evaluates owner implicit rights independently: if the object's owner SID appears in the restricting SID list, the restricted pass grants READ_CONTROL and WRITE_DAC (subject to the same OWNER RIGHTS suppression rules as the normal pass). If the owner SID is not a restricting SID, the restricted pass does not grant implicit rights.

§7.4.4 Virtual groups in the restricted pass

If the object's owner SID appears in the restricting SIDs, S-1-3-4 (OWNER RIGHTS) is injected as a virtual restricting SID. If self_sid appears in the restricting SIDs, S-1-5-10 (PRINCIPAL_SELF) is injected. This ensures the restricted pass handles these well-known SIDs consistently.

§7.4.5 Restricted device groups

If the token has restricted device groups, the restricted pass swaps them in so that conditional expression operators (Device_Member_of, etc.) evaluate against the restricted set, not the unrestricted device groups.