opschain admin trust ceiling

packs:agentspacks:agent-governance

opschain admin trust ceiling <type> --ceiling <advise|supervised|autonomous> [--note <text>] [--server <url>] [--auth-token <token>]

Upserts one agent type's tier ceiling (PUT /api/trust/ceilings/{type}). Agents whose manifest declares <type> never act above the ceiling, whatever their grants say — the effective tier is min(grant tier, ceiling), one more least-permissive conjunct in the compiled trust snapshot. The write is governance-determined:

• Step-up floored — on a session-backed admin plane the verb trust.ceiling_write requires a live elevation (ceiling writes are grant-class writes).
• Pack-gated — the surface requires packs:agent-governance.
• Audited — every write lands an info:trust:ceiling_set event carrying the type, the new ceiling, the previous one and the actor.

Raising the ai type from its shipped supervised default to autonomous is the deliberate act that unlocks unattended AI change — cite the trust-review evidence in --note. Lowering a ceiling clamps every covered agent's effective tier immediately: the snapshot invalidates on the write, so a grant that read autonomous resolves supervised on the next request with grant_tier/tier_ceiling stamped in the audit metadata.

Flags

Flag	Meaning
--ceiling <tier>	The ceiling tier: advise, supervised or autonomous (required; autonomous is the no-clamp posture).
--note <text>	Audit note, e.g. the trust-review evidence the raise cites.
--server <url>	Server base URL. Default: the active context, then OPSCHAIN_SERVER.
--auth-token <token>	Admin bearer token override. Default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login for that server.

Output

The stored row: type, ceiling, note, updated_by, updated_at.