---
title: "Resources"
description: "How resources are described as URL patterns: exact paths, {placeholder} segments and * wildcards."
canonical: "https://docs.cm.com/governance/guides/core-concepts/resources"
---

# Resources

> How resources are described as URL patterns: exact paths, {placeholder} segments and * wildcards.

Source: https://docs.cm.com/governance/guides/core-concepts/resources

A **resource** is the thing being accessed, such as a profile, an agent or a record inside an application. Governance checks access on the resource itself, not just on the application.

Each application defines its own resources. Governance does not decide what they are.

## What a resource looks like

A resource is a path, like a web address:

```text
/resource/5/items/10
```

## Patterns

When you assign a role, you say _which resources_ it covers by writing a pattern.

| Pattern | Covers |
| - | - |
| `/resource/5/items/10` | Exactly that resource. |
| `/resource/5/items/{id}` | Any single item under `/resource/5/items/`. `{id}` stands for one path segment. |
| `/resource/5/*` | Everything under `/resource/5/`, at any depth. |
| `*` or left blank | Every resource. |

Matching ignores upper and lower case, and ignores anything after a `?` in the address.

## Good to know

- **A blank resource means everything.** Leaving the field empty gives the role on all resources, not none.
- **Patterns are not checked for typos.** A wrong pattern is accepted and simply matches nothing, so the person gets no access. Check the path after you assign.
- **Applications can list their resources for you.** If an application supports it, you can pick resources from a list instead of typing a pattern.

## Related

- [Permissions](https://docs.cm.com/governance/guides/core-concepts/permissions)
- [Role assignments](https://docs.cm.com/governance/guides/core-concepts/role-assignments)
- [How access decisions work](https://docs.cm.com/governance/guides/how-access-decisions-work)