Workspace editor
Standard role- ✓ Edit content
- ✓ Create drafts
- — Cannot manage billing
Access policy cards
Express role permissions and access context without hidden policy assumptions.
Live preview
HTML
<article class="xsh-policy-card">
<div>
<h3>Workspace editor</h3>
<span class="xsh-badge xsh-badge--primary">Standard role</span>
</div>
<ul>
<li>✓ Edit content</li>
<li>✓ Create drafts</li>
<li>— Cannot manage billing</li>
</ul>
<button class="xsh-button xsh-button--secondary" data-xsh-toast="info" data-xsh-message="Policy changes require secure server permissions.">Review policy</button>
</article>Installation & markup
Include the local stylesheet and script once on the page, then place the component inside a data-xsh-ui root. The example above works without a build system.
<link rel="stylesheet" href="/dist/xshna-ui.css">
<div data-xsh-ui>
<!-- Add the HTML example above -->
</div>
<script defer src="/dist/xshna-ui.js"></script>Component API
Public classes, attributes and hooks used by this example. Keep the xsh- prefix intact.
| Identifier | Contract |
|---|---|
xsh-policy-card | Used by the example markup and component styles or behavior. |
xsh-badge | Used by the example markup and component styles or behavior. |
Accessibility & keyboard
Text labels convey permissions; button reports that authorization is server-owned.
Implementation note. This does not implement access control. Enforce authorization outside the UI.
Interaction contract
Behavioral components use the shared delegated runtime; visual-only primitives rely on semantic HTML and CSS. Runtime controls emit bubbling xsh:* CustomEvents; bind application handlers to those events when server persistence, API data or navigation is required.