opschain security roles

Included from Basic tierpacks:security-governance

Manage the local-lane grants of the security-domain roles:

• security_administrator — owns the security domain: git identity policies, the allow-all switch, the seeded review queue and role grants. Delegable per project (a project security administrator manages that project's policy entries only).
• auditor — metadata-only read over everything, zero write verbs, masked forms everywhere, no unmask privilege. Granting it requires the packs:security-governance entitlement.

The local grant row is the break-glass lane — explicit, individually revocable, and audited loudly (api:security_role_grants:*). Directory estates should prefer the enterprise lane: map a provider group to the role name through opschain admin identity-providers group mappings, so leavers lose the role with their directory account. The roles view shows WHY a user holds a role: this list is the flag lane; mapped grants live on the provider's group mappings.

Granting and revoking are acts of the global security administrator (or a superuser).

Subcommands

• list, grant <role> <user>, revoke <grant-id>.

See also

• opschain docs cli/security-roles-grant
• opschain docs cli/security-roles-list