opschain admin authz rules create

Included from Basic tierpacks:security-governance

Creates a standalone authorisation rule: a path plus whichever of the four actions you grant. Every action defaults to denied — a rule created with no action flags grants nothing. The rule takes effect only once a policy links it (admin authz policies attach-rule) and that policy is assigned.

opschain admin authz rules create --path /projects/demo --readable --executable --name "demo access"
created authorisation rule /projects/demo (0199c2…)

Flags

Flag	Meaning
--path <rule-path>	Required. The rule path; the server normalises and stores the regex-era ^-anchored form.
--name <name>	Optional display name.
--readable	Grant the readable action.
--updatable	Grant the updatable action.
--deletable	Grant the deletable action.
--executable	Grant the executable action.
--require-step-up	Demand an elevated (stepped-up) session whenever this rule matches a write-shaped action (update, delete, execute). Setting it requires the packs:security-governance entitlement; with the pack lapsed the stored bit is kept but not enforced.
--step-up-on-read	Extend the step-up demand to reads too. Binds only together with --require-step-up — read step-up is always a deliberate per-rule choice.

-o, --output json|yaml prints the created resource instead of the one-line confirmation.

Exit codes

• 0 — created.
• 1 — the server refused (the 422 detail passes through).
• 2 — usage (--path missing, or no server target — the shared named error on opschain docs cli/admin-authz-rules).

See also

• opschain docs cli/admin-authz-policies-attach-rule — putting the rule to work.
• opschain docs cli/admin-authz-convert-report — the path grammar conversion the stored form belongs to.