opschain admin authz rules create
Included from Basic tierpacks:security-governance
Creates a standalone authorisation rule: a path plus whichever of the four
actions you grant. Every action defaults to denied — a rule created
with no action flags grants nothing. The rule takes effect only once a
policy links it (admin authz policies attach-rule) and that policy is
assigned.
opschain admin authz rules create --path /projects/demo --readable --executable --name "demo access"
created authorisation rule /projects/demo (0199c2…)
Flags
| Flag | Meaning |
|---|---|
--path <rule-path> | Required. The rule path; the server normalises and stores the regex-era ^-anchored form. |
--name <name> | Optional display name. |
--readable | Grant the readable action. |
--updatable | Grant the updatable action. |
--deletable | Grant the deletable action. |
--executable | Grant the executable action. |
--require-step-up | Demand an elevated (stepped-up) session whenever this rule matches a write-shaped action (update, delete, execute). Setting it requires the packs:security-governance entitlement; with the pack lapsed the stored bit is kept but not enforced. |
--step-up-on-read | Extend the step-up demand to reads too. Binds only together with --require-step-up — read step-up is always a deliberate per-rule choice. |
-o, --output json|yaml prints the created resource instead of the one-line
confirmation.
Exit codes
- 0 — created.
- 1 — the server refused (the 422 detail passes through).
- 2 — usage (
--pathmissing, or no server target — the shared named error onopschain docs cli/admin-authz-rules).
See also
opschain docs cli/admin-authz-policies-attach-rule— putting the rule to work.opschain docs cli/admin-authz-convert-report— the path grammar conversion the stored form belongs to.