autonomy rbac role create

Create a custom RBAC role

Synopsis

Creates a new custom role with the specified permissions.

Predefined roles (operator, analyst, auditor, integrator) cannot be redefined.

CONSTRAINT C-07: The role name must not be "admin", "superuser", "root", or
"system". No role may grant mutation authority over edge runtimes.

	Known permissions:
  fleet:read            fleet status grid
  activation:read       activation timeline events
  telemetry:read        OTel event stream
  lock:read             BLAKE3 fingerprint chain
  release_channel:read  release channel viewer (read-only)
  wal:read              WAL buffer inspection
  policy_eval:read      policy evaluation results
  audit_history:read    full audit history (auditor only)
  signature:verify      re-run BLAKE3 verify on artifacts
  bundle:build          bundle builder UI (produces download only)
  cert:read             certificate list/check-revocation
  cert:manage           certificate issue/rotate/revoke/sync
  rbac:manage           RBAC role creation and role assignment
  simulation:run        policy simulation sandbox

Usage

autonomy rbac role create [flags]

Options

      --by string            operator identity creating this role (for audit)
      --description string   human-readable description
      --name string          role name (required)
      --permissions string   comma-separated permissions (required; see --help for valid values)
      --rbac-dir string      RBAC store directory (default: AUTONOMY_RBAC_DIR or XDG state path)

See also