opschain admin governance waivers create
Included from Basic tier
opschain admin governance waivers create --control <id|key> --justification <why> --requested-by <who> --expires <RFC3339> [--scope-path <path>] [--external-ref <ref>]
Grants a time-boxed waiver (GovernanceService.CreateWaiver). The
recording caller becomes approved_by and must differ from
--requested-by (never self-granted); expiry is mandatory and renewal is
review-before-renewal — a new waiver. Admin plane plus a stepped-up
session — an unelevated call is refused with the CLI elevation hint.
-o json / -o yaml emit the granted waiver.
Flags
| Flag | Meaning |
|---|---|
--control <id|key> | The waived control (mandatory). |
--justification <why> | Why the exception is granted (mandatory). |
--requested-by <who> | Who asked for the exception (mandatory; must differ from the caller). |
--expires <RFC3339> | The mandatory expiry, e.g. 2027-01-31T00:00:00Z. |
--scope-path <path> | The estate path the waiver is scoped to (empty scopes it to the control). |
--external-ref <ref> | A typed external reference (ticket, approval record). |
Exit codes
| Code | Meaning |
|---|---|
| 0 | Granted; the waiver id and expiry are reported. |
| 1 | Refused — the admin-floor or step-up refusal, a self-grant, or an unknown control. |
| 2 | Usage error, including missing mandatory flags, a non-RFC3339 --expires, or a missing server target. |