opschain admin authz rules update
Included from Basic tierpacks:security-governance
Updates an authorisation rule in place, by id. The command first reads the
stored rule, then overlays only the flags you actually passed — an
unsupplied flag keeps its stored value, so granting one action never
silently revokes the others. Action flags are explicit booleans in both
directions: --readable grants, --readable=false revokes, and the same
for the other three.
opschain admin authz rules update 0199c2… --deletable --updatable=false
updated authorisation rule 0199c2…
A rule linked to a system policy refuses updates server-side (the 422 detail passes through).
Flags
| Flag | Meaning |
|---|---|
--path <rule-path> | New rule path. |
--name <name> | New display name. |
--readable | Set the readable action (grant, or =false to revoke). |
--updatable | Set the updatable action. |
--deletable | Set the deletable action. |
--executable | Set the executable action. |
--require-step-up | Set the step-up demand on the rule's matched writes (grant, or =false to clear). Turning it on requires the packs:security-governance entitlement; clearing it never does, so a lapsed estate can always unwind. |
--step-up-on-read | Set the read opt-in for the step-up demand (binds only while require_step_up is set). |
-o, --output json|yaml prints the updated resource.
Exit codes
- 0 — updated.
- 1 — the rule does not exist, or the server refused.
- 2 — usage, including the no-flags case.
Named errors
nothing to update — pass --path, --name and/or the action flags— the command was given no flags at all; exits 2.
See also
opschain docs cli/admin-authz-rules-show— the stored values the overlay starts from.