opschain approval-policies update

packs:change-governance

opschain approval-policies update <policy-id> [flags]

Updates an approval policy (ChangeGovernanceService.UpdateApprovalPolicy): only the flags you pass change; --action-pattern, --where and the approver flags replace their stored sets wholesale. Needs the delegable change-governance determination and a stepped-up session.

Flags

Flag	Meaning
--name <name>	Rename the policy.
--path-pattern <glob>	Replace the node-path glob the policy covers.
--action-pattern <glob>	Replace the action-name globs with the given set (repeatable).
--clear-action-patterns	Cover every action again.
--where <predicate>	Replace the metadata predicates with the given set (repeatable; same grammar as create).
--clear-where	Drop every metadata predicate.
--approver-user <name>	A user on the replacement approver list: a principal id, username or <provider>:<username>, stored as the principal id (repeatable).
--approver-group <name>	A directory group on the replacement approver list (repeatable).
--approver-kind <kind>	A resolved approver kind on the replacement list (repeatable).
--quorum <n>	Distinct approvals required.
--self-approval	Let the requester's or change owner's approval count.
--strict	Never subsumed, and refuse covered creates on entitlement lapse.
--require-window	Release covered subjects only inside an open admitting maintenance window.
--require-step-up	Demand an elevated session on a matched create.
--require-change-reference	Demand a typed external change reference before approval.
--quorum-ttl <duration>	How long gathered approvals may wait for quorum.
--approval-validity <duration>	How long a completed approval stays valid.
--enabled	Enable or disable the policy (--enabled=false disables).

Exit codes

Code	Meaning
0	Done.
1	The server refused or failed the request (named in the error).
2	Usage error — missing mandatory flags or no server target.