Version: v5.6.1

opschain admin authz policies

Included from Basic tier

Manage authorisation policies: named rule bundles assigned to users and groups. These verbs are the CLI twin of the UI's RBAC editor, over the user-authenticated v2 AuthorisationPolicyService RPCs — log in first (opschain login); the server gates every write on the caller's policy-admin standing, and its named refusals (for example on system policies) pass through verbatim as the server answered <code>: <message>.

Policies are addressed by name or id interchangeably (names are unique server-side). A policy carries rules two ways: inline in a YAML definition (create/update, which replace the rule set wholesale) or by linking standalone rules (attach-rule/detach-rule).

Subcommand	Purpose
`list`	List policies — `opschain docs cli/admin-authz-policies-list`
`show`	One policy with its rules and assignments — `opschain docs cli/admin-authz-policies-show`
`create`	Create from a YAML definition — `opschain docs cli/admin-authz-policies-create`
`update`	Replace a definition from YAML — `opschain docs cli/admin-authz-policies-update`
`delete`	Delete (preview first) — `opschain docs cli/admin-authz-policies-delete`
`assign`	Replace the assignment set — `opschain docs cli/admin-authz-policies-assign`
`assignments`	List the assignments — `opschain docs cli/admin-authz-policies-assignments`
`attach-rule`	Link an existing rule — `opschain docs cli/admin-authz-policies-attach-rule`
`detach-rule`	Unlink a rule — `opschain docs cli/admin-authz-policies-detach-rule`

policies itself takes no flags. Every subcommand shares two named failures: with no server target it refuses with authorisation policies need a server target — pass --server <url> or 'opschain context use <name>' (local mode has no authorisation policies) (exits 2), and an unresolvable <name-or-id> fails with no authorisation policy named "<arg>" (and none with that id) is visible to you (exits 1).

See also​

See also