opschain admin security convert-policy-admins
Included from Basic tier
Converts upstream's securing-prefix policy administrators onto the
security_administrator role. Upstream delegated policy
administration through rules whose path ends in /authorisation_policies;
in OpsChain the role is the gate and those rules grant nothing, so every
principal holding an updatable securing prefix becomes the matching
grant:
| held | becomes |
|---|---|
/authorisation_policies (the global prefix) | a global security_administrator grant |
/projects/<code>/authorisation_policies | a project delegation on <code> |
| a deeper prefix (environment, asset depth) | the enclosing project's delegation, reported as widened — the path held is kept on the grant (widened_from_path) so the reviewer decides whether the person should hold the whole project |
| a group holding a prefix | a group-targeted grant naming the group; membership stays the directory's business |
Converted grants are active on creation (nobody is locked out on
upgrade day), flagged converted_from: securing_prefix with the path held,
and queued for the global security administrator to confirm or revoke
— opschain security roles review or the Security administration tab.
Every converted grant records audit:security_role_grants:converted
(principal id, never a username) and the run records
audit:security_role_grants:conversion with its counts.
The securing rules themselves are retired: their policy links and rule
rows are removed (the policies stay) and each is listed in the report. A
holding that cannot become a grant is reported and skipped: an everyone
assignment (skipped_everyone — grant the role explicitly if that was
intended), a read-only prefix (skipped_read_only — it held no management
authority), a prefix on a project that no longer exists
(skipped_missing_project), or a pattern rather than a literal path
(skipped_unresolvable). A principal already holding the equivalent grant
is reported existing and left as it was.
The server runs this job itself at every boot, right after the
migrations, and persists the report (security_policy_admin_conversions);
the boot notice names the report and the counts. The job is idempotent — a
rerun finds no securing prefix and reports nothing to do — so this command
exists for the dry run before the upgrade and for re-runs after it.
opschain admin security convert-policy-admins --store postgres://… --dry-run
Securing-prefix conversion (dry run — nothing written, cli): converted=3 widened=1 skipped_everyone=1 retired_rules=5
TARGET PRINCIPAL HELD PROJECT OUTCOME GRANT
user 019a… (global) - converted -
user 019a… /projects/web /projects/web converted -
user 019a… /projects/web/environments/dev /projects/web widened -
group ldap:policy-admins (global) - converted -
…
opschain admin security convert-policy-admins --store … --report prints
the last persisted report instead of running.
Flags
| Flag | Meaning |
|---|---|
--store <dsn> | Required. A postgres:// (or postgresql://) DSN over the adopted authorisation tables. |
--dry-run | Compute and print the conversion plan without writing anything. |
--report | Print the last persisted conversion report instead of running. |
Global -o, --output json|yaml switches to the machine document (the rows,
the retired rules and the counts map).
See also
opschain docs cli/security-roles-reviewopschain docs resources/security_role_grantopschain docs resources/authorisation_policy— who may change a policy or rule now.