opschain security roles grant
Included from Basic tierpacks:security-governance
Grants security_administrator or auditor to a user through the local
lane (the break-glass flag). --project delegates the role to one project;
without it the grant is global. The grantee is a user id or username (a
username held by accounts of more than one provider refuses by name — pass
the id). Granting auditor requires the packs:security-governance
entitlement; the grant refuses naming the pack otherwise.
opschain security roles grant security_administrator alice
Granted security_administrator to alice (scope global) as grant 019a...
opschain security roles grant security_administrator bob --project web
Granted security_administrator to bob (scope web) as grant 019a...
Only the global security administrator (or a superuser) may grant. The
grant is audited as the loud, break-glass-capable kind
(api:security_role_grants:create) and applies on the next authorisation
decision.
Flags
| Flag | Meaning |
|---|---|
--project <code> | Project code to delegate the role to (empty: a global grant). |
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
See also
opschain docs cli/security-roles-revoke