opschain approval-policies create
packs:change-governance
opschain approval-policies create --name <name> --path-pattern <glob> [flags]
Creates one approval policy — a row of the change matrix
(ChangeGovernanceService.CreateApprovalPolicy). Needs the delegable
change-governance determination (updatable on /governance/change<scope>)
and a stepped-up session (opschain elevate).
Flags
| Flag | Meaning |
|---|---|
--name <name> | The policy's name (mandatory). |
--path-pattern <glob> | The node-path glob the policy covers, e.g. /projects/p/environments/prod/** (mandatory). |
--scope-path <path> | The node path the write authorises against (defaults to the policy's own coverage). |
--action-pattern <glob> | An action-name glob the policy covers; none covers every action (repeatable). |
--where <predicate> | A metadata predicate covered subjects must match: <field>=<value>, <field> in <v1>,<v2>, <field> before|after <YYYY-MM-DD>, or <field> is true|false|unclassified|elapsed (repeatable; predicates AND). |
--approver-user <name> | A username on the approver list (repeatable). |
--approver-group <name> | A directory group on the approver list (repeatable). |
--approver-kind <kind> | A resolved approver kind, e.g. impacted_asset_owners (repeatable). |
--quorum <n> | Distinct approvals required (default 1). |
--self-approval | Let the requester's or change owner's approval count. |
--strict | Never subsumed, and refuse covered creates on entitlement lapse. |
--require-window | Release covered subjects only inside an open admitting maintenance window. |
--require-step-up | Demand an elevated session on a matched create. |
--require-change-reference | Demand a typed external change reference before approval. |
--quorum-ttl <duration> | How long gathered approvals may wait for quorum (default 168h). |
--approval-validity <duration> | How long a completed approval stays valid (default 336h). |
--disabled | Create the policy disabled. |
Exit codes
| Code | Meaning |
|---|---|
| 0 | Done. |
| 1 | The server refused or failed the request (named in the error). |
| 2 | Usage error — missing mandatory flags or no server target. |
See also
opschain docs change-governance— the policy model and every lever.opschain docs cli/approval-policies— the noun.