CLI command
skarbiec grant capability
Issue one finite, use-counted redemption of an already declared grant, against a routed resource, for the local Unix-socket broker.
Invocation#
skarbiec grant capability --agent <name> --purpose <text> --resource <resource> --target <name> [--ttl <seconds>] [--max-uses <1..16>] [--authorization-id <id>]Purpose#
Issue one finite, use-counted redemption of an already declared grant, against a routed resource, for the local Unix-socket broker.
Required inputs and options#
- Requires exact agent, purpose, resource, and target. --ttl defaults to 600 seconds; --max-uses defaults to one; authorization id is optional.
Output and state effects#
- Stores capability metadata in private side state and prints capability_id plus status issued. It returns no credential value; capability-serve is what redeems it.
Refusals#
- Refuses malformed names, TTL outside 1..3600, uses outside 1..16, an invalid authorization id, and a non-challenge resource whose route is missing or whose credential cannot serve. A refusal is a document on stdout and the same sentence as an error on stderr, naming the coordinate and the repair.