opschain admin trust ceilings
packs:agentspacks:agent-governance
opschain admin trust ceilings [--filter <col=value>] [--server <url>] [--auth-token <token>]
Lists the per-type tier ceilings (GET /api/trust/ceilings) — the
conjunct on every trust resolution: an agent whose manifest
declares a type never acts above that type's ceiling, whatever its grants
say. The effective tier is always
effective = min(grant tier, type tier_ceiling, every matching node ceiling)
composed inside the same compiled trust snapshot grant resolution uses, so a
ceiling write takes effect on the very next agent request. The
node-classification conjuncts are listed by
opschain docs cli/admin-trust-node-ceilings (the same
GET /api/trust/ceilings document carries both sets).
Out of the box one row exists: the ai type, ceilinged at supervised
— unattended AI mutation of an estate is an explicit,
evidenced decision, never a default. A type without a row carries no
conjunct. Set or raise a ceiling with opschain docs cli/admin-trust-ceiling.
Flags
| Flag | Meaning |
|---|---|
--filter <col=value> | Repeatable table filter over the listed columns. |
--server <url> | Server base URL. Default: the active context, then OPSCHAIN_SERVER. |
--auth-token <token> | Admin bearer token override. Default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login for that server. |
Output
A table of TYPE, CEILING, UPDATED BY and NOTE; -o json|yaml
returns the raw {"ceilings": [...]} document.