opschain security roles

Included from Basic tierpacks:security-governance

Manage the local-lane grants of the security-domain roles:

• security_administrator — owns the security domain: the authorisation policies and rules (path RBAC: this role, not any rule path, is the gate on every policy, rule, link and assignment write), git identity policies, the allow-all switch, the review queues and role grants. Delegable per project (a project security administrator manages that project's policy entries and only the authorisation policies whose rule paths all sit under the project; system policies stay superuser-only).
• auditor — metadata-only read over everything, zero write verbs, masked forms everywhere, no unmask privilege. Granting it requires the packs:security-governance entitlement.

The local grant row is the break-glass lane — explicit, individually revocable, and audited loudly (api:security_role_grants:*). Directory estates should prefer the enterprise lane: map a provider group to the role name through opschain admin identity-providers group mappings, so leavers lose the role with their directory account. The roles view shows WHY a user holds a role: this list is the flag lane; mapped grants live on the provider's group mappings.

Granting and revoking are acts of the global security administrator (or a superuser).

A grant targets a user (the break-glass flag) or, when the upgrade converted a group that held an upstream securing prefix, a group. Converted grants carry their origin and sit in the review queue (review) until the global security administrator confirms or revokes them.

Subcommands

• list, grant <role> <user>, revoke <grant-id>;
• review list|confirm|revoke — the converted-grant review queue.

See also

• opschain docs cli/security-roles-grant
• opschain docs cli/security-roles-list
• opschain docs cli/security-roles-review
• opschain docs resources/security_role_grant