opschain admin authz rules
Included from Basic tierpacks:security-governance
Manage standalone authorisation rules: a node path with its four grantable
actions — readable, updatable, deletable, executable. A rule grants nothing
by itself; it takes effect when a policy links it
(admin authz policies attach-rule) and that policy is assigned to a
principal. These verbs ride the v2 API
(AuthorisationPolicyService rule RPCs) as the logged-in user
(opschain login); the server gates writes on policy-admin standing and
answers its refusals as named Connect errors, rendered verbatim.
Rules are addressed by id, never by path — a path is not unique.
| Subcommand | Purpose |
|---|---|
list | List rules — opschain docs cli/admin-authz-rules-list |
show | One rule — opschain docs cli/admin-authz-rules-show |
create | Create a standalone rule — opschain docs cli/admin-authz-rules-create |
update | Change a rule in place — opschain docs cli/admin-authz-rules-update |
delete | Delete (preview first) — opschain docs cli/admin-authz-rules-delete |
rules itself takes no flags. Every subcommand shares the no-server named
error authorisation rules need a server target — pass --server <url> or 'opschain context use <name>' (local mode has no authorisation rules)
(exits 2).
See also
opschain docs cli/admin-authz— policy vs rule vs assignment.opschain docs cli/admin-authz-convert-report— classifying legacy rule paths for the glob grammar.