Revoke-ZrRole
Revokes a role previously granted to a subject at a scope, removing the assignment across the cluster.
Syntax
Revoke-ZrRole
-Subject <string>
-Role <string>
[-Scope <string>]
[-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
[-WhatIf] [-Confirm]
Description
Revoke-ZrRole removes the given role from a subject at the specified scope, fanning the revocation out to every connected manager so the assignment is removed cluster-wide. Requires a connected manager (an active workspace or explicit -Managers) and an admin token. See Authorization & RBAC for roles and scope syntax.
This operation removes access. Revoking a role can immediately reduce or eliminate what a user or application is permitted to do. Confirm the exact grant with Get-ZrGrant -Subject <name> first, and match the -Scope used when the role was granted (an omitted -Scope targets the root scope). Use -WhatIf to preview.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
-Subject | string | Yes | The subject (user or service account) to revoke the role from. Position 0. |
-Role | string | Yes | The name of the role to revoke. Position 1. |
-Scope | string | No | The scope from which the role is revoked; defaults to the root scope when omitted. |
-Managers | string[] | No | Management Service endpoints to target; when omitted the active workspace's managers are used. |
-Port | int | No | Management Service port for bare-host managers. Default 7801. |
-Token | string | No | Admin bearer token for authenticated control-plane calls. |
-TimeoutSec | int | No | Per-request timeout in seconds. Default 30. |
Supports -WhatIf and -Confirm.
Examples
Preview revoking app1's DataWriter role on the orders store.
Revoke-ZrRole -Subject app1 -Role DataWriter -Scope zaris:store:orders -WhatIf
Revoke app1's DataWriter role on the orders store from all managers.
Revoke-ZrRole -Subject app1 -Role DataWriter -Scope zaris:store:orders