authzctl

Overview ¶

Command authzctl manages the authz role store from the shell. It is the canonical bootstrap path: granting the first global admin before any admin UI exists, and the recovery path if a host's grant flow misbehaves.

Usage:

authzctl --driver postgres --dsn $DATABASE_URL <command> [args]

Commands:

grant   ISSUER SUBJECT ROLE [--module M] [--by WHO]
revoke  ISSUER SUBJECT ROLE [--module M]
roles   ISSUER SUBJECT [--module M]
holders ROLE
migrate