opschain approval-policies update
packs:change-governance
opschain approval-policies update <policy-id> [flags]
Updates an approval policy
(ChangeGovernanceService.UpdateApprovalPolicy): only the flags you pass
change; --action-pattern, --where and the approver flags replace their
stored sets wholesale. Needs the delegable change-governance determination
and a stepped-up session.
Flags
| Flag | Meaning |
|---|---|
--name <name> | Rename the policy. |
--path-pattern <glob> | Replace the node-path glob the policy covers. |
--action-pattern <glob> | Replace the action-name globs with the given set (repeatable). |
--clear-action-patterns | Cover every action again. |
--where <predicate> | Replace the metadata predicates with the given set (repeatable; same grammar as create). |
--clear-where | Drop every metadata predicate. |
--approver-user <name> | A username on the replacement approver list (repeatable). |
--approver-group <name> | A directory group on the replacement approver list (repeatable). |
--approver-kind <kind> | A resolved approver kind on the replacement list (repeatable). |
--quorum <n> | Distinct approvals required. |
--self-approval | Let the requester's or change owner's approval count. |
--strict | Never subsumed, and refuse covered creates on entitlement lapse. |
--require-window | Release covered subjects only inside an open admitting maintenance window. |
--require-step-up | Demand an elevated session on a matched create. |
--require-change-reference | Demand a typed external change reference before approval. |
--quorum-ttl <duration> | How long gathered approvals may wait for quorum. |
--approval-validity <duration> | How long a completed approval stays valid. |
--enabled | Enable or disable the policy (--enabled=false disables). |
Exit codes
| Code | Meaning |
|---|---|
| 0 | Done. |
| 1 | The server refused or failed the request (named in the error). |
| 2 | Usage error — missing mandatory flags or no server target. |