Access Policy Check

goodmem access-policy check

Check the current principal's effective authority

Synopsis

Evaluate up to 50 advisory authorization checks for the authenticated principal.

Repeat --check for each OPERATION:RESOURCE_KIND[:RESOURCE_UUID] question. INSTANCE targets omit the UUID; every concrete resource target requires it. GoodMem deliberately reports a missing target and a denied operation identically as allowed=false. A later resource call always reauthorizes against fresh state.

Top-level creates and singleton collection or administrative checks use INSTANCE. CREATE_MEMORY and LIST_MEMORY instead use their parent SPACE. Reads, mutations, proxy operations, and access-policy administration use the concrete resource. LIST_API_KEY and LIST_RETRIEVE_MEMORY_LOG_POLICY do not have supported preflight checks. The server validates every operation and target pairing.

goodmem access-policy check [flags]

Examples

  goodmem access-policy check \
    --check CREATE_SPACE:INSTANCE \
    --check READ_SPACE:SPACE:70e025f6-76ca-4cbe-b8fc-7dab8e84590a

Options

      --check stringArray   Authorization question OPERATION:RESOURCE_KIND[:RESOURCE_UUID] (repeatable, maximum 50)
  -f, --format string       Output format: table, json, compact, quiet (default "table")
  -h, --help                help for check

Options inherited from parent commands

      --api-key string   API key for authentication (can also be set via GOODMEM_API_KEY environment variable)
      --server string    GoodMem server address (gRPC API)