opschain admin authz
Included from Basic tier
Authorisation-model administration. The model has three parts: a rule is a node path plus four grantable actions (readable, updatable, deletable, executable); a policy is a named bundle of rules; an assignment binds a policy to a principal — a username, a group name, or everyone when neither is set. A principal's authority is the union of the rules on every policy assigned to it (directly or through its groups).
The subtree has two halves with different trust boundaries:
policiesandrulesare the CRUD verbs: they call the server's user-authenticated API as the logged-in user (opschain login), and the server gates every write on the caller's policy-admin standing.convert-reportandreview-exportare offline reporting verbs: they read a database directly via a store DSN and need no API credential.
| Subcommand | Purpose |
|---|---|
policies | Manage policies, their rule links and their assignments — opschain docs cli/admin-authz-policies |
rules | Manage standalone authorisation rules — opschain docs cli/admin-authz-rules |
convert-report | Classify stored rule paths for the regex-to-glob conversion — opschain docs cli/admin-authz-convert-report |
review-export | Export the access-review entitlement report — opschain docs cli/admin-authz-review-export |
admin authz itself takes no flags; see each subcommand's page.
See also
opschain docs cli/admin-users— the local-identity verbs the assignments ultimately point at.