opschain admin authz policies assign

Included from Basic tier

Replaces a policy's assignment set with exactly the users and groups given — it does not add to the existing set. An assignment binds the policy to a username or a group name; --clear replaces the set with nothing, revoking the policy from everyone it was assigned to.

opschain admin authz policies assign ops-team --user alice --group ops
replaced the assignments of "ops-team": now 2 assignment(s)
assignments:
  KIND   ASSIGNEE  ID
  user   alice     0199c4…
  group  ops       0199c5…

Group names resolve against a principal's effective groups — directory groups and local groups share one namespace (see opschain docs cli/admin-groups), so one group assignment covers both provider populations.

A user assignment is per-identity: it binds the policy to exactly one account, never to every provider's account of that name. A --user username held by accounts of more than one provider is refused as ambiguous — pass --user-id <uuid> to pick the exact account (ids are in opschain admin users list). A same-named local/LDAP mirror that must share authority needs its own assignment (migration 00058 created those rows for pairs that shared a grant before the change — see opschain docs identity). Naming the same account twice in one set is refused with the named 422 below.

Flags

Flag	Meaning
--user <username>	Assign to this username — refused as ambiguous when accounts of more than one provider hold it (repeatable).
--user-id <uuid>	Assign to this exact user id, disambiguating a shared username (repeatable).
--group <groupname>	Assign to this group name (repeatable).
--clear	Replace the assignment set with nothing. Conflicts with the other flags.

Exit codes

• 0 — assignments replaced (-o json|yaml prints the new assignment resources).
• 1 — the policy cannot be resolved, or the server refused.
• 2 — usage.

Named errors

• pass at least one --user/--user-id/--group, or --clear to remove every assignment — no flags at all; exits 2.
• --clear conflicts with --user/--user-id/--group — exits 2.
• '<username>' already holds this policy — the same account named twice in the replacement set, by name or id (server 422); exits 1.
• '<username>' names accounts of more than one provider (<providers>) — assignments are per-identity, so pass user_id to pick one — an ambiguous --user (server 422); exits 1.

See also

• opschain docs cli/admin-authz-policies-assignments — reading the current set before replacing it.