opschain admin trust node-ceilings
packs:agentspacks:agent-governance
opschain admin trust node-ceilings [--filter <col=value>] [--server <url>] [--auth-token <token>]
Lists the node-classification tier ceilings (GET /api/trust/ceilings,
node_ceilings) — the conjuncts on every trust resolution:
at a target node whose effective metadata matches a rule's
predicates, no agent acts above that rule's ceiling, whatever its grants or
type ceiling say. The effective tier is always
effective = min(grant tier, type ceiling, every matching node ceiling)
Matching evaluates the compiled effective-metadata snapshot at the frozen target on each request — classification is inherited down the node tree, an unset field matches nothing, and a reclassification moves the clamp on the very next request. This is how "autonomous in Dev, supervised wherever critical-operation" is classification policy rather than per-subtree grant bookkeeping.
No rules ship by default. Write one with
opschain docs cli/admin-trust-node-ceiling-set.
Flags
| Flag | Meaning |
|---|---|
--filter <col=value> | Repeatable table filter over the listed columns. |
--server <url> | Server base URL. Default: the active context, then OPSCHAIN_SERVER. |
--auth-token <token> | Admin bearer token override. Default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login for that server. |
Output
A table of ID, WHEN (the predicates, rendered in the predicate grammar
node-ceiling set accepts), CEILING, UPDATED BY and NOTE;
-o json|yaml returns the rows from the
{"ceilings": [...], "node_ceilings": [...]} document.