opschain admin authz policies create

Included from Basic tier

Creates an authorisation policy from a YAML definition file. The file's vocabulary is strict — exactly the API's writable policy attributes — and an unknown key is refused by name:

name: ops-team
description: Operations access
authorisation_rules:
  - path: /projects/demo
    readable: true
    updatable: true
    deletable: false
    executable: true

authorisation_rules is optional: a policy can be created empty and have standalone rules linked afterwards with attach-rule. name is required.

Flags

Flag	Meaning
-f, --file <file.yaml>	Required. The YAML policy definition (accepted keys: name, description, authorisation_rules).

Exit codes

• 0 — created: prints created authorisation policy "<name>" (<id>) (-o json|yaml prints the created resource instead).
• 1 — the server refused (for example the caller lacks policy-admin standing, or the name is taken — the server's 422 detail passes through).
• 2 — usage.

Named errors

• <file.yaml> must set name — exits 2.
• <file.yaml>: unknown policy attribute(s) <keys> (accepted: name, description, authorisation_rules) — exits 2.
• parse <file.yaml>: <yaml error> — the file is not valid YAML; exits 1.

See also

• opschain docs cli/admin-authz-policies-update — the same file format, replacing an existing definition.
• opschain docs cli/admin-authz-policies-assign — pointing the new policy at users and groups.