opschain admin agent owner
packs:agents
opschain admin agent owner <agent-id> --owned-by <user-or-group>
opschain admin agent owner <agent-id> --clear
Sets (or clears) the agent's owning human or team (POST /api/agents/{id}/owner) — the admin override of the
manifest-declared owned_by. The owner must exist in the identity catalog
as a known user or a known group (local, or a provider snapshot); an unknown
name refuses with a named 422, never a silent store of an unroutable owner.
Ownership is accountability and escalation routing only — it never
derives a privilege ceiling or floor (what an agent may do is
decided case-by-case per trust grant). The owner shows on the fleet views
(opschain admin agents list, admin agent show) and the trust review, and
rides the agent's warn events (warn:agent:halted,
warn:agent:request_refused) so escalations reach the owning team. An
override survives re-registration: a manifest that declares no owned_by
preserves the stored owner. Offboarding a user with
opschain admin users reassign-automations moves the agents they own to
the target service account alongside their triggers and schedules.
Every change lands an info:agent:owner_changed audit event.
Trust presumes an owner: a supervised or autonomous trust grant to an
unowned agent refuses by name until this verb (or the GUI's owner
control) assigns one. Clearing an owner does not touch existing grants —
the agent keeps working and the fleet views flag it as unowned.
Flags
| Flag | Meaning |
|---|---|
--owned-by <name> | The owning user or group (must exist in the identity catalog). |
--clear | Clear the agent's owner. |
--server <url> | Server base URL. Default: the active context, then OPSCHAIN_SERVER. |
--auth-token <token> | Admin bearer token override. Default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login for that server. |
Output
A machine document with the agent id and the stored owned_by.