opschain admin transport-grants
packs:rpc
Manage transport grants — the authority layer over the transport-
provider catalog. A grant answers who may use which
provider, where, for what: a subject (user, group,
service_account or agent_group — humans and agents gate
identically), the granted provider (a code or a code glob such as
nonprod-*), the node-path scope glob sessions may target, rpc
action patterns (exec, put, get, sync, facts, ensure,
globs; default everything), rate/session caps and an optional
per-use step-up demand.
Granting rides the approvals funnel: on a composition carrying the
approval fabric a new grant lands pending and opens a strict
checklist in the same inbox every other held subject enters (opschain approvals); quorum completion activates it, rejection and quorum-TTL
expiry revoke it. The direct approve/reject verbs serve estates
without the fabric and refuse while a ceremony is open.
Enforcement happens at step dispatch: a session with no covering active
grant refuses by name and lands warn:transport:refused, an over-cap
request warn:transport:cap_refused, and every minted session
info:transport:session (for an ssh-ca session with the minted
certificate's fingerprint and TTL — identifiers, never material).
Creating or approving a grant requires the packs:rpc entitlement;
reject and revoke stay ungated so a lapsed estate can always unwind
authority. Grant writes carry the step-up session floor, every verb
sits behind the /admin updatable determination, and every write is
audited (api:transport_grants:*).
| Subcommand | Purpose |
|---|---|
list | Every grant: subject, provider, scope, actions, status. |
show <id> | One grant's full shape and lifecycle. |
create | Propose a grant (pending under the funnel; active without it). |
approve <id> | Activate a pending grant directly (base posture). |
reject <id> | Refuse a pending grant — it revokes without activating. |
revoke <id> | Terminally revoke a pending or active grant. |
Exit codes: 0 on success, 1 when a call fails or the token is rejected, 2 for usage errors.
See also
opschain docs cli/admin-transport-providers— the catalog grants confer use of.opschain docs cli/approvals— the inbox a held grant is approved through.