Access Policy

goodmem access-policy

Manage authorization grants and role assignments

Synopsis

Manage the policies that give principals authority in GoodMem.

A direct grant gives one principal, or every authenticated principal, one operation over a selector. A role assignment attaches a code-defined bundle of capabilities to the singleton instance or to one space. Revocation preserves both kinds of records as audit history.

Resource commands such as "goodmem space access" provide shorter paths for common create and list operations. Use this canonical command when you need to inspect or revoke a record by its own UUID.

Examples

  # Give one principal read access to a space
  goodmem access-policy grant create \
    --principal b3303d0a-1a4a-493f-b9bf-38e37153b5a2 \
    --operation READ_SPACE --selector EXACT \
    --resource-kind SPACE --resource-id 70e025f6-76ca-4cbe-b8fc-7dab8e84590a

  # Make a principal an administrator of one space
  goodmem access-policy role-assignment assign \
    --principal b3303d0a-1a4a-493f-b9bf-38e37153b5a2 \
    --role SPACE_ADMIN \
    --resource-kind SPACE --resource-id 70e025f6-76ca-4cbe-b8fc-7dab8e84590a

Options

  -h, --help   help for access-policy

Options inherited from parent commands

      --api-key string   API key for authentication (can also be set via GOODMEM_API_KEY environment variable)
      --server string    GoodMem server address (gRPC API)