uip gov aops-policy deployment and deployed-policy

Syntax and options for assigning AOps governance policies to tenants, users, and groups, and for resolving the effective policy at runtime, using `uip gov aops-policy deployment` and `uip gov aops-policy deployed-policy`.

uip gov aops-policy deployment assigns AOps governance policies to governance subjects (tenants, users, groups); uip gov aops-policy deployed-policy resolves which policy actually applies at runtime after inheritance is walked. For authoring the policy records themselves, see aops-policy. For the parent tool overview, see uip gov.

Konzepte

• Resolution order is user → group → tenant (user beats group beats tenant). A subject with no explicit assignment for a (product, license type) inherits from the next level up.
• null pins "No Policy" — passing null as a configure entry's policyIdentifier explicitly blocks inheritance from the level below, rather than leaving the entry unset (which inherits normally).
• Every configure verb is a full replace, not a merge. Entries omitted from the input file are removed from that subject's assignment list. To add one assignment while keeping others, start from that subject's get output, edit it, and resubmit the whole array.
• Scope differs per level: tenant assignments are scoped by (productIdentifier, licenseTypeIdentifier) — one policy per license type per product. User and group overrides are scoped by productIdentifier alone (not license-type-specific).
• Removing the last assignment on a tenant is refused, not silently ignored — the governance service treats saving an empty assignment array as a no-op, so deployment tenant remove explicitly errors rather than reporting success while leaving the assignment in place. Pin "policyIdentifier": null via configure instead.
• To verify what actually applies, use deployed-policy, not deployment ... get — the latter shows only explicit overrides at one level, not the resolved result.

Zusammenfassung

uip gov aops-policy deployment tenant list [--product-name <name>] [--limit <n>] [--offset <n>]
uip gov aops-policy deployment tenant get <tenantIdentifier>
uip gov aops-policy deployment tenant configure <tenantIdentifier> --tenant-name <name> --input <path>
uip gov aops-policy deployment tenant remove <tenantIdentifier> --product-name <name> [--license-type <type>]

uip gov aops-policy deployment user list [--limit <n>] [--offset <n>]
uip gov aops-policy deployment user get <userIdentifier>
uip gov aops-policy deployment user configure <userIdentifier> --user <name> --input <path> [--source <source>] [--email <email>]
uip gov aops-policy deployment user delete <userIdentifier>

uip gov aops-policy deployment group list [--limit <n>] [--offset <n>]
uip gov aops-policy deployment group get <groupIdentifier>
uip gov aops-policy deployment group configure <groupIdentifier> --group <name> --input <path> [--source <source>]
uip gov aops-policy deployment group delete <groupIdentifier>

uip gov aops-policy deployed-policy get <license-type> <product-name> <tenantIdentifier> [--s2s-token <token> [--user-id <id> | --tenant-only]]
uip gov aops-policy deployed-policy list <license-type> <product-name> <tenantIdentifier>

Every verb also accepts --login-validity <minutes> (ignored on deployed-policy get when --s2s-token is set).

uip gov aops-policy deployment tenant

Baseline policy assignments per tenant, scoped by (productIdentifier, licenseTypeIdentifier). User and group assignments override these.

uip gov aops-policy deployment tenant list

Lists tenants registered in the governance system with their current assignments. Triggers an upstream sync from OMS before returning, so the result reflects the latest tenant catalog (new tenants, disabled/re-enabled state) — not just governance's local cache.

Optionen

Long	Wert	Beschreibung
--product-name <product-name>	string	Return only tenants with an assignment for this product.
--limit <n>	Integer	Page size. Default 20.
--offset <n>	Integer	Zero-based page index.

Beispiel

uip gov aops-policy deployment tenant list --product-name StudioX --limit 2

Datenform (--output json)

{
  "Code": "AopsPolicyDeploymentTenantList",
  "Data": [
    {
      "identifier": "a1b2c3d4-0000-0000-0000-000000000100",
      "name": "Acme Tenant",
      "tenantPolicies": [
        { "productIdentifier": "StudioX", "licenseTypeIdentifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }
      ]
    }
  ]
}

uip gov aops-policy deployment tenant get

Argumente

Name	Erforderlich	Zweck
<tenantIdentifier>	ja	Tenant GUID, from tenant list.

Beispiel

uip gov aops-policy deployment tenant get a1b2c3d4-0000-0000-0000-000000000100

Datenform (--output json)

Same shape as one tenant list entry.

uip gov aops-policy deployment tenant configure

Replace a tenant's (product, license type) assignments from a JSON file. Full replace — entries not in the file are removed. Triggers an upstream OMS sync before saving, so a freshly-created (or status-changed) tenant is reconciled first.

Argumente

Name	Erforderlich	Zweck
<tenantIdentifier>	ja	Tenant GUID to configure.

Optionen

Long	Wert	Erforderlich	Beschreibung
--tenant-name <tenantName>	string	ja	Display name — must match the tenant's name in the governance service.
--input <path>	Pfad	ja	JSON array of {productIdentifier, licenseTypeIdentifier, policyIdentifier}. policyIdentifier: null pins "No Policy"; omit an entry to inherit normally.

Beispiel

uip gov aops-policy deployment tenant configure a1b2c3d4-0000-0000-0000-000000000100 --tenant-name "Acme Tenant" --input tenant-policies.json

Datenform (--output json)

{
  "Code": "AopsPolicyDeploymentTenantConfigure",
  "Data": [
    { "productIdentifier": "StudioX", "licenseTypeIdentifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }
  ]
}

uip gov aops-policy deployment tenant remove

Remove a tenant's assignment(s) for a product without rewriting the full list yourself — a client-side read-filter-save.

Hinweis:

Not atomic. This is read → filter → save; a concurrent change to the same tenant between the read and the save is lost. Avoid running concurrently against the same tenant. Cannot clear the last assignment — the service treats saving an empty array as a no-op, so this command refuses that case rather than reporting false success. Pin "policyIdentifier": null via configure instead.

Argumente

Name	Erforderlich	Zweck
<tenantIdentifier>	ja	Tenant GUID.

Optionen

Long	Wert	Erforderlich	Beschreibung
--product-name <product-name>	string	ja	Product to unpin.
--license-type <license-type>	string	nein	Narrow removal to one license type. Omit to remove every license-type entry for the product.

Fails with "No matching policy assignment to remove" if nothing matches.

Beispiel

uip gov aops-policy deployment tenant remove a1b2c3d4-0000-0000-0000-000000000100 --product-name StudioX

Datenform (--output json)

{
  "Code": "AopsPolicyDeploymentTenantRemove",
  "Data": {
    "removed": [{ "productIdentifier": "StudioX", "licenseTypeIdentifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }],
    "tenantPolicies": []
  }
}

uip gov aops-policy deployment user

Per-user overrides, scoped by productIdentifier only (not license-type). User assignments win over group and tenant.

uip gov aops-policy deployment user list

Lists users the governance service has seen (assigned a policy to, or imported) — not a full identity-provider roster.

Optionen

Long	Wert	Beschreibung
--limit <n>	Integer	Page size. Default 20.
--offset <n>	Integer	Zero-based page index.

Beispiel

uip gov aops-policy deployment user list --limit 2

Datenform (--output json)

{ "Code": "AopsPolicyDeploymentUserList", "Data": [{ "identifier": "a1b2c3d4-0000-0000-0000-000000000201", "name": "[e-mail]", "source": "cloud" }] }

uip gov aops-policy deployment user get

Per-product overrides explicitly assigned to one user — tenant/group inheritance is not resolved here (use deployed-policy get for the effective value). Returns [] if the user has no overrides.

Argumente

Name	Erforderlich	Zweck
<userIdentifier>	ja	User GUID, from user list.

Beispiel

uip gov aops-policy deployment user get a1b2c3d4-0000-0000-0000-000000000201

Datenform (--output json)

{ "Code": "AopsPolicyDeploymentUserGet", "Data": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }

uip gov aops-policy deployment user configure

Replace a user's per-product overrides. Auto-registers the user (via an add-user call) if not already known to governance; otherwise runs as a full-replace upsert.

Argumente

Name	Erforderlich	Zweck
<userIdentifier>	ja	User GUID to configure — from user list, or the upstream identity provider.

Optionen

Long	Wert	Erforderlich	Beschreibung
--user <user>	string	ja	Display name stored alongside the override (surfaced in audit logs/UI).
--input <path>	Pfad	ja	JSON array of {productIdentifier, policyIdentifier}. policyIdentifier: null pins "No Policy".
--source <source>	string	nein	Identity-provider source (e.g. local, aad, cloud). Default local. Used only on the upsert path — first-time registration resolves source from CIS instead.
--email <email>	string	nein	Email used only when registering a brand-new user. Ignored once the user is already known. Defaults to --user.

Beispiel

uip gov aops-policy deployment user configure a1b2c3d4-0000-0000-0000-000000000201 --user [e-mail] --input user-policies.json

Datenform (--output json)

{
  "Code": "AopsPolicyDeploymentUserConfigure",
  "Data": { "identifier": "a1b2c3d4-0000-0000-0000-000000000201", "userPolicies": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }
}

uip gov aops-policy deployment user delete

Clear every per-product override for a user in one call — equivalent to configure with an empty array, without needing a JSON file. The user falls back to group/tenant inheritance for all products afterward.

Argumente

Name	Erforderlich	Zweck
<userIdentifier>	ja	User GUID, from user list.

Beispiel

uip gov aops-policy deployment user delete a1b2c3d4-0000-0000-0000-000000000201

Datenform (--output json)

{ "Code": "AopsPolicyDeploymentUserDelete", "Data": { "Status": "Deleted", "identifier": "a1b2c3d4-0000-0000-0000-000000000201" } }

uip gov aops-policy deployment group

Per-group overrides, scoped by productIdentifier. Sits between user and tenant in resolution order (user wins over group, group wins over tenant). Verb shape is identical to deployment user (list/get/configure/delete) — only the subject differs.

uip gov aops-policy deployment group list

Optionen

Same as deployment user list (--limit, --offset).

Beispiel

uip gov aops-policy deployment group list --limit 2

Datenform (--output json)

{ "Code": "AopsPolicyDeploymentGroupList", "Data": [{ "identifier": "a1b2c3d4-0000-0000-0000-000000000301", "name": "Engineering", "source": "cloud" }] }

uip gov aops-policy deployment group get

Argumente

Name	Erforderlich	Zweck
<groupIdentifier>	ja	Group GUID, from group list.

Datenform (--output json)

{ "Code": "AopsPolicyDeploymentGroupGet", "Data": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }

Returns [] when the group has no overrides.

uip gov aops-policy deployment group configure

Same shape and auto-registration behavior as deployment user configure, with --group <name> in place of --user <name> (no --email/--source semantics differ — --source here has the same default/meaning). Group members fall back to tenant inheritance for any product not in the input file.

Argumente

Name	Erforderlich	Zweck
<groupIdentifier>	ja	Group GUID to configure.

Optionen

Long	Wert	Erforderlich	Beschreibung
--group <group>	string	ja	Display name stored alongside the override.
--input <path>	Pfad	ja	JSON array of {productIdentifier, policyIdentifier}.
--source <source>	string	nein	Identity-provider source. Default local.

Beispiel

uip gov aops-policy deployment group configure a1b2c3d4-0000-0000-0000-000000000301 --group Engineering --input group-policies.json

Datenform (--output json)

{
  "Code": "AopsPolicyDeploymentGroupConfigure",
  "Data": { "identifier": "a1b2c3d4-0000-0000-0000-000000000301", "groupPolicies": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }
}

uip gov aops-policy deployment group delete

Removes the group and all its policy overrides from governance. The group itself remains in the upstream identity provider — this only clears governance state. Members fall back to user-level or tenant-level assignments.

Argumente

Name	Erforderlich	Zweck
<groupIdentifier>	ja	Group GUID, from group list.

Datenform (--output json)

{ "Code": "AopsPolicyDeploymentGroupDelete", "Data": { "Status": "Deleted", "identifier": "a1b2c3d4-0000-0000-0000-000000000301" } }

uip gov aops-policy deployed-policy

Read-only. Resolves the single effective policy for a subject after inheritance is walked — the answer to "what actually applies right now."

uip gov aops-policy deployed-policy get

Argumente

Name	Erforderlich	Zweck
<license-type>	ja	License type name (e.g. Attended) — from license-type list.
<product-name>	ja	Product name (e.g. StudioX) — from product list.
<tenantIdentifier>	ja	Tenant GUID — from deployment tenant list.

Optionen

Long	Wert	Beschreibung
--s2s-token <token>	string	Service-to-service bearer token, overriding the user token for this call only. Prefer the UIP_S2S_TOKEN environment variable over this flag — a CLI-argument token is visible in process listings (ps aux, /proc/*/cmdline).
--user-id <userId>	string	Resolve the effective policy for this specific user (full user→group→tenant walk). Requires an S2S token. Mutually exclusive with --tenant-only.
--tenant-only	Markieren	Resolve the tenant-level policy only, ignoring user/group overrides. Requires an S2S token. Mutually exclusive with --user-id.

Three resolution modes: default (caller's own user token, resolves for the caller), S2S + --user-id (resolve for a specific user), S2S + --tenant-only (tenant-level only). --user-id/--tenant-only without an S2S token fails client-side.

Beispiel

uip gov aops-policy deployed-policy get Attended StudioX a1b2c3d4-0000-0000-0000-000000000100

Datenform (--output json)

{
  "Code": "AopsPolicyDeployedPolicyGet",
  "Data": { "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Baseline StudioX Policy", "data": { "allowAnalytics": true, "maxProjects": 5 } }
}

When no rule matches and there's no default, Data is { "Message": "No policy applies." } instead (the server's 204).

uip gov aops-policy deployed-policy list

Unlike get (top-priority effective policy only), returns every rule that applies to a (license type, product, tenant) for the calling user, in priority order — useful for understanding why a particular value wins. User-token only; S2S/impersonation isn't supported here.

Argumente

Same three positional arguments as deployed-policy get.

Beispiel

uip gov aops-policy deployed-policy list Attended StudioX a1b2c3d4-0000-0000-0000-000000000100

Datenform (--output json)

{
  "Code": "AopsPolicyDeployedPolicyList",
  "Data": [
    { "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Baseline StudioX Policy", "priority": 10, "source": "Tenant" },
    { "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000002", "name": "Restricted StudioX Policy", "priority": 20, "source": "User" }
  ]
}

Returns [] when no rules apply.

Zugehörig

• uip gov — tool overview and Access Policies.
• aops-policy — policy CRUD, product/license-type catalogs, templates.
• compliance-packs — bundle policies into a named framework.

Siehe auch

• Tools (Plugins)
• Globale Optionen
• Exitcodes