opschain security

Included from Basic tierpacks:security-governance

The Security Administration command group: the git identity authorisation policy and the security-domain roles.

The git identity policy closes the two ungated dimensions of the authorisation matrix — which git remote and which rev a change may run from. It is a deny-all-by-default allow list owned by the security_administrator role (never node settings, so node update rights confer no policy rights), evaluated at every use-time door:

• direct change create against a project or environment,
• workflow change-step reach (evaluated as the run's creator),
• retry with refresh_git_rev (the re-resolved rev must pass),
• template-version create and sync (the content-entry doors).

A denied use answers a named validation error and records a warn:security:git_remote_refused event. Remotes a user cannot use still appear on remote-serving reads, annotated usable: false, so GUIs grey rather than hide.

Two roles administer the domain:

• security_administrator — reads and writes security-domain objects. Grantable globally or delegated per project (a project security administrator manages that project's entries only). Two grant lanes: a directory group mapping (opschain admin identity-providers group mappings with the role name) and the local grant row (opschain security roles grant, the break-glass lane — audited loudly).
• auditor — metadata-only read over everything, zero write verbs, no unmask privilege. Granting it requires the packs:security-governance entitlement.

Superusers retain access to everything. Every verb below answers only to security administrators, auditors (reads) and superusers.

Subcommands

• opschain security git-policies — the allow-list entries and the allow-all switch.
• opschain security roles — the local-lane role grants.

See also

• opschain docs cli/security-git-policies
• opschain docs cli/security-roles