Grant-ZrRole
Grants a role to a subject (a user or service account), optionally scoped to a resource such as a store.
Syntax
Grant-ZrRole
-Subject <string>
-Role <string>
[-Scope <string>]
[-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
[-WhatIf] [-Confirm]
Description
Grant-ZrRole grants the given role to a subject, optionally scoped to a resource, fanning the grant out to every connected manager so the assignment is consistent cluster-wide. Requires a connected manager (an active workspace or explicit -Managers) and an admin token. See Authorization & RBAC for the available roles, scope syntax, and how grants combine into effective permissions.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
-Subject | string | Yes | The subject (user or service account) to grant the role to. Position 0. |
-Role | string | Yes | The name of the role to grant. Position 1. |
-Scope | string | No | The scope at which the role is granted; defaults to the root scope when omitted. |
-Managers | string[] | No | Management Service endpoints to target; when omitted the active workspace's managers are used. |
-Port | int | No | Management Service port for bare-host managers. Default 7801. |
-Token | string | No | Admin bearer token for authenticated control-plane calls. |
-TimeoutSec | int | No | Per-request timeout in seconds. Default 30. |
Supports -WhatIf and -Confirm.
Examples
Grant app1 the DataWriter role scoped to the orders store on all managers.
Grant-ZrRole -Subject app1 -Role DataWriter -Scope zaris:store:orders