opschain admin trust
packs:agentspacks:agent-governance
The agent governance surface: what an agent may do, as opposed to
whether it runs (opschain admin agent). Trust is expressed as
subtree-scoped grants — (subject, node-path scope, action patterns) with
a tier: advise (recommendations only), supervised (executes behind an
approval gate) or autonomous (executes ungated); no matching grant means
refusal. Grants compile into a snapshot consulted on every agent request,
and recompile immediately on every write. Alongside grants sit
assets-under-management assignments — the agent's SME inventory,
carrying a configurable ADVISE floor — and the human approval verbs for
agent-proposed grant changes, which are always human-approved.
| Subcommand | Purpose |
|---|---|
grant | Write a trust grant (tiered actions and/or an act_as class) — opschain docs cli/admin-trust-grant. |
list | Every grant: active, pending and revoked history — opschain docs cli/admin-trust-list. |
revoke | Revoke a grant, effective immediately — opschain docs cli/admin-trust-revoke. |
approve | Activate a pending agent proposal, or apply a pending revoke — opschain docs cli/admin-trust-approve. |
reject | Refuse a pending proposal, or clear a pending revoke — opschain docs cli/admin-trust-reject. |
assign | Record assets under management for an agent — opschain docs cli/admin-trust-assign. |
assignments | List all assignments — opschain docs cli/admin-trust-assignments. |
unassign | Remove an assignment — opschain docs cli/admin-trust-unassign. |
ceilings | List the classification tier ceilings — opschain docs cli/admin-trust-ceilings. |
ceiling | Set a classification's tier ceiling (step-up floored, audited) — opschain docs cli/admin-trust-ceiling. |
node-ceilings | List the node-classification tier ceilings — opschain docs cli/admin-trust-node-ceilings. |
node-ceiling | Write or remove a node-classification ceiling (step-up floored, audited) — opschain docs cli/admin-trust-node-ceiling. |
Related settings
agents.assignment_floor— what an assignment confers with no matching grant:advise(default) ordeny.agents.approvers— fallback approvers for SUPERVISED outcomes.
See also
opschain docs cli/admin-agent-trust-review— one agent's posture and track record.opschain docs cli/admin-agent— lifecycle control of the agents themselves.