# ImpersonationSessionMode

A model the API reference uses in a request or a response. The operation pages link every field typed as this model here.

How permissions are evaluated for the duration of an impersonation session.

## Values

| Value | Description |
| --- | --- |
| `Unspecified` | No mode has been derived. Treated as the most restrictive posture everywhere (equivalent to ReadOnly for enforcement), so an uninitialized value can never widen a session. |
| `ReadOnly` | Every permission classified Write, Delete or Manage is denied for the duration of the session. Read-classified permissions evaluate against the impersonated scope exactly as in Full. |
| `Intersect` | A permission is granted only where the impersonated scope grants it and the acting user's own roles or direct grants allow it. The permission-type classifier is not consulted: what the acting user may not do outside the session, they may not do inside it. |
| `Full` | The impersonated scope's own grants apply unmodified, including every write, delete and manage surface. The phase 1 read-write posture. |

## See also

- [All documentation](https://devportal.demo.winkpg.io/llms.txt): the machine-readable index of every public page on this site.