Access Policy Grant Create

goodmem access-policy grant create

Create one direct authorization grant

Synopsis

Create one direct authorization grant.

Specify exactly one audience with --principal or --all-authenticated. ANY and OWN selectors do not take a resource target. EXACT and DIRECT_MEMBERS_OF require --resource-kind and, except for the singleton INSTANCE, --resource-id. The server remains authoritative for operation, selector, resource-kind, audience, existence, and authorization compatibility.

goodmem access-policy grant create [flags]

Examples

  # Grant one principal read access to one space
  goodmem access-policy grant create \
    --principal b3303d0a-1a4a-493f-b9bf-38e37153b5a2 \
    --operation READ_SPACE --selector EXACT \
    --resource-kind SPACE --resource-id 70e025f6-76ca-4cbe-b8fc-7dab8e84590a

  # Grant an instance-wide operation over resources owned by the audience
  goodmem access-policy grant create \
    --principal b3303d0a-1a4a-493f-b9bf-38e37153b5a2 \
    --operation UPDATE_SPACE --selector OWN

Options

      --all-authenticated      Grant to every authenticated principal
  -f, --format string          Output format: json, compact, quiet (default "json")
  -h, --help                   help for create
      --id string              Optional client-provided authorization-grant UUID
      --operation string       Access-policy operation (for example READ_SPACE)
      --principal string       Principal UUID receiving the grant
      --resource-id string     Policy target UUID; omit for INSTANCE
      --resource-kind string   Typed policy target kind (for example INSTANCE or SPACE)
      --selector string        Resource selector: ANY, OWN, EXACT, or DIRECT_MEMBERS_OF

Options inherited from parent commands

      --api-key string   API key for authentication (can also be set via GOODMEM_API_KEY environment variable)
      --server string    GoodMem server address (gRPC API)