uip gov aops-policy deployment and deployed-policy

Syntax and options for assigning AOps governance policies to tenants, users, and groups, and for resolving the effective policy at runtime, using `uip gov aops-policy deployment` and `uip gov aops-policy deployed-policy`.

uip gov aops-policy deployment assigns AOps governance policies to governance subjects (tenants, users, groups); uip gov aops-policy deployed-policy resolves which policy actually applies at runtime after inheritance is walked. For authoring the policy records themselves, see aops-policy. For the parent tool overview, see uip gov.

Conceptos

• Resolution order is user → group → tenant (user beats group beats tenant). A subject with no explicit assignment for a (product, license type) inherits from the next level up.
• null pins "No Policy" — passing null as a configure entry's policyIdentifier explicitly blocks inheritance from the level below, rather than leaving the entry unset (which inherits normally).
• Every configure verb is a full replace, not a merge. Entries omitted from the input file are removed from that subject's assignment list. To add one assignment while keeping others, start from that subject's get output, edit it, and resubmit the whole array.
• Scope differs per level: tenant assignments are scoped by (productIdentifier, licenseTypeIdentifier) — one policy per license type per product. User and group overrides are scoped by productIdentifier alone (not license-type-specific).
• Removing the last assignment on a tenant is refused, not silently ignored — the governance service treats saving an empty assignment array as a no-op, so deployment tenant remove explicitly errors rather than reporting success while leaving the assignment in place. Pin "policyIdentifier": null via configure instead.
• To verify what actually applies, use deployed-policy, not deployment ... get — the latter shows only explicit overrides at one level, not the resolved result.

Sinopsis

uip gov aops-policy deployment tenant list [--product-name <name>] [--limit <n>] [--offset <n>]
uip gov aops-policy deployment tenant get <tenantIdentifier>
uip gov aops-policy deployment tenant configure <tenantIdentifier> --tenant-name <name> --input <path>
uip gov aops-policy deployment tenant remove <tenantIdentifier> --product-name <name> [--license-type <type>]

uip gov aops-policy deployment user list [--limit <n>] [--offset <n>]
uip gov aops-policy deployment user get <userIdentifier>
uip gov aops-policy deployment user configure <userIdentifier> --user <name> --input <path> [--source <source>] [--email <email>]
uip gov aops-policy deployment user delete <userIdentifier>

uip gov aops-policy deployment group list [--limit <n>] [--offset <n>]
uip gov aops-policy deployment group get <groupIdentifier>
uip gov aops-policy deployment group configure <groupIdentifier> --group <name> --input <path> [--source <source>]
uip gov aops-policy deployment group delete <groupIdentifier>

uip gov aops-policy deployed-policy get <license-type> <product-name> <tenantIdentifier> [--s2s-token <token> [--user-id <id> | --tenant-only]]
uip gov aops-policy deployed-policy list <license-type> <product-name> <tenantIdentifier>

Every verb also accepts --login-validity <minutes> (ignored on deployed-policy get when --s2s-token is set).

uip gov aops-policy deployment tenant

Baseline policy assignments per tenant, scoped by (productIdentifier, licenseTypeIdentifier). User and group assignments override these.

uip gov aops-policy deployment tenant list

Lists tenants registered in the governance system with their current assignments. Triggers an upstream sync from OMS before returning, so the result reflects the latest tenant catalog (new tenants, disabled/re-enabled state) — not just governance's local cache.

Opciones

Largo	Valor	Descripción
--product-name <product-name>	String	Return only tenants with an assignment for this product.
--limit <n>	Entero	Page size. Default 20.
--offset <n>	Entero	Zero-based page index.

Ejemplo

uip gov aops-policy deployment tenant list --product-name StudioX --limit 2

Forma de datos (--json de salida)

{
  "Code": "AopsPolicyDeploymentTenantList",
  "Data": [
    {
      "identifier": "a1b2c3d4-0000-0000-0000-000000000100",
      "name": "Acme Tenant",
      "tenantPolicies": [
        { "productIdentifier": "StudioX", "licenseTypeIdentifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }
      ]
    }
  ]
}

uip gov aops-policy deployment tenant get

Argumentos

Nombre	Obligatorio	Propósito
<tenantIdentifier>	Sí	Tenant GUID, from tenant list.

Ejemplo

uip gov aops-policy deployment tenant get a1b2c3d4-0000-0000-0000-000000000100

Forma de datos (--json de salida)

Same shape as one tenant list entry.

uip gov aops-policy deployment tenant configure

Replace a tenant's (product, license type) assignments from a JSON file. Full replace — entries not in the file are removed. Triggers an upstream OMS sync before saving, so a freshly-created (or status-changed) tenant is reconciled first.

Argumentos

Nombre	Obligatorio	Propósito
<tenantIdentifier>	Sí	Tenant GUID to configure.

Opciones

Largo	Valor	Obligatorio	Descripción
--tenant-name <tenantName>	String	Sí	Display name — must match the tenant's name in the governance service.
--input <path>	Ruta	Sí	JSON array of {productIdentifier, licenseTypeIdentifier, policyIdentifier}. policyIdentifier: null pins "No Policy"; omit an entry to inherit normally.

Ejemplo

uip gov aops-policy deployment tenant configure a1b2c3d4-0000-0000-0000-000000000100 --tenant-name "Acme Tenant" --input tenant-policies.json

Forma de datos (--json de salida)

{
  "Code": "AopsPolicyDeploymentTenantConfigure",
  "Data": [
    { "productIdentifier": "StudioX", "licenseTypeIdentifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }
  ]
}

uip gov aops-policy deployment tenant remove

Remove a tenant's assignment(s) for a product without rewriting the full list yourself — a client-side read-filter-save.

Nota:

Not atomic. This is read → filter → save; a concurrent change to the same tenant between the read and the save is lost. Avoid running concurrently against the same tenant. Cannot clear the last assignment — the service treats saving an empty array as a no-op, so this command refuses that case rather than reporting false success. Pin "policyIdentifier": null via configure instead.

Argumentos

Nombre	Obligatorio	Propósito
<tenantIdentifier>	Sí	Tenant GUID.

Opciones

Largo	Valor	Obligatorio	Descripción
--product-name <product-name>	String	Sí	Product to unpin.
--license-type <license-type>	String	No	Narrow removal to one license type. Omit to remove every license-type entry for the product.

Fails with "No matching policy assignment to remove" if nothing matches.

Ejemplo

uip gov aops-policy deployment tenant remove a1b2c3d4-0000-0000-0000-000000000100 --product-name StudioX

Forma de datos (--json de salida)

{
  "Code": "AopsPolicyDeploymentTenantRemove",
  "Data": {
    "removed": [{ "productIdentifier": "StudioX", "licenseTypeIdentifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }],
    "tenantPolicies": []
  }
}

uip gov aops-policy deployment user

Per-user overrides, scoped by productIdentifier only (not license-type). User assignments win over group and tenant.

uip gov aops-policy deployment user list

Lists users the governance service has seen (assigned a policy to, or imported) — not a full identity-provider roster.

Opciones

Largo	Valor	Descripción
--limit <n>	Entero	Page size. Default 20.
--offset <n>	Entero	Zero-based page index.

Ejemplo

uip gov aops-policy deployment user list --limit 2

Forma de datos (--json de salida)

{ "Code": "AopsPolicyDeploymentUserList", "Data": [{ "identifier": "a1b2c3d4-0000-0000-0000-000000000201", "name": "[e-mail]", "source": "cloud" }] }

uip gov aops-policy deployment user get

Per-product overrides explicitly assigned to one user — tenant/group inheritance is not resolved here (use deployed-policy get for the effective value). Returns [] if the user has no overrides.

Argumentos

Nombre	Obligatorio	Propósito
<userIdentifier>	Sí	User GUID, from user list.

Ejemplo

uip gov aops-policy deployment user get a1b2c3d4-0000-0000-0000-000000000201

Forma de datos (--json de salida)

{ "Code": "AopsPolicyDeploymentUserGet", "Data": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }

uip gov aops-policy deployment user configure

Replace a user's per-product overrides. Auto-registers the user (via an add-user call) if not already known to governance; otherwise runs as a full-replace upsert.

Argumentos

Nombre	Obligatorio	Propósito
<userIdentifier>	Sí	User GUID to configure — from user list, or the upstream identity provider.

Opciones

Largo	Valor	Obligatorio	Descripción
--user <user>	String	Sí	Display name stored alongside the override (surfaced in audit logs/UI).
--input <path>	Ruta	Sí	JSON array of {productIdentifier, policyIdentifier}. policyIdentifier: null pins "No Policy".
--source <source>	String	No	Identity-provider source (e.g. local, aad, cloud). Default local. Used only on the upsert path — first-time registration resolves source from CIS instead.
--email <email>	String	No	Email used only when registering a brand-new user. Ignored once the user is already known. Defaults to --user.

Ejemplo

uip gov aops-policy deployment user configure a1b2c3d4-0000-0000-0000-000000000201 --user [e-mail] --input user-policies.json

Forma de datos (--json de salida)

{
  "Code": "AopsPolicyDeploymentUserConfigure",
  "Data": { "identifier": "a1b2c3d4-0000-0000-0000-000000000201", "userPolicies": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }
}

uip gov aops-policy deployment user delete

Clear every per-product override for a user in one call — equivalent to configure with an empty array, without needing a JSON file. The user falls back to group/tenant inheritance for all products afterward.

Argumentos

Nombre	Obligatorio	Propósito
<userIdentifier>	Sí	User GUID, from user list.

Ejemplo

uip gov aops-policy deployment user delete a1b2c3d4-0000-0000-0000-000000000201

Forma de datos (--json de salida)

{ "Code": "AopsPolicyDeploymentUserDelete", "Data": { "Status": "Deleted", "identifier": "a1b2c3d4-0000-0000-0000-000000000201" } }

uip gov aops-policy deployment group

Per-group overrides, scoped by productIdentifier. Sits between user and tenant in resolution order (user wins over group, group wins over tenant). Verb shape is identical to deployment user (list/get/configure/delete) — only the subject differs.

uip gov aops-policy deployment group list

Opciones

Same as deployment user list (--limit, --offset).

Ejemplo

uip gov aops-policy deployment group list --limit 2

Forma de datos (--json de salida)

{ "Code": "AopsPolicyDeploymentGroupList", "Data": [{ "identifier": "a1b2c3d4-0000-0000-0000-000000000301", "name": "Engineering", "source": "cloud" }] }

uip gov aops-policy deployment group get

Argumentos

Nombre	Obligatorio	Propósito
<groupIdentifier>	Sí	Group GUID, from group list.

Forma de datos (--json de salida)

{ "Code": "AopsPolicyDeploymentGroupGet", "Data": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }

Returns [] when the group has no overrides.

uip gov aops-policy deployment group configure

Same shape and auto-registration behavior as deployment user configure, with --group <name> in place of --user <name> (no --email/--source semantics differ — --source here has the same default/meaning). Group members fall back to tenant inheritance for any product not in the input file.

Argumentos

Nombre	Obligatorio	Propósito
<groupIdentifier>	Sí	Group GUID to configure.

Opciones

Largo	Valor	Obligatorio	Descripción
--group <group>	String	Sí	Display name stored alongside the override.
--input <path>	Ruta	Sí	JSON array of {productIdentifier, policyIdentifier}.
--source <source>	String	No	Identity-provider source. Default local.

Ejemplo

uip gov aops-policy deployment group configure a1b2c3d4-0000-0000-0000-000000000301 --group Engineering --input group-policies.json

Forma de datos (--json de salida)

{
  "Code": "AopsPolicyDeploymentGroupConfigure",
  "Data": { "identifier": "a1b2c3d4-0000-0000-0000-000000000301", "groupPolicies": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }
}

uip gov aops-policy deployment group delete

Removes the group and all its policy overrides from governance. The group itself remains in the upstream identity provider — this only clears governance state. Members fall back to user-level or tenant-level assignments.

Argumentos

Nombre	Obligatorio	Propósito
<groupIdentifier>	Sí	Group GUID, from group list.

Forma de datos (--json de salida)

{ "Code": "AopsPolicyDeploymentGroupDelete", "Data": { "Status": "Deleted", "identifier": "a1b2c3d4-0000-0000-0000-000000000301" } }

uip gov aops-policy deployed-policy

Read-only. Resolves the single effective policy for a subject after inheritance is walked — the answer to "what actually applies right now."

uip gov aops-policy deployed-policy get

Argumentos

Nombre	Obligatorio	Propósito
<license-type>	Sí	License type name (e.g. Attended) — from license-type list.
<product-name>	Sí	Product name (e.g. StudioX) — from product list.
<tenantIdentifier>	Sí	Tenant GUID — from deployment tenant list.

Opciones

Largo	Valor	Descripción
--s2s-token <token>	String	Service-to-service bearer token, overriding the user token for this call only. Prefer the UIP_S2S_TOKEN environment variable over this flag — a CLI-argument token is visible in process listings (ps aux, /proc/*/cmdline).
--user-id <userId>	String	Resolve the effective policy for this specific user (full user→group→tenant walk). Requires an S2S token. Mutually exclusive with --tenant-only.
--tenant-only	Marca	Resolve the tenant-level policy only, ignoring user/group overrides. Requires an S2S token. Mutually exclusive with --user-id.

Three resolution modes: default (caller's own user token, resolves for the caller), S2S + --user-id (resolve for a specific user), S2S + --tenant-only (tenant-level only). --user-id/--tenant-only without an S2S token fails client-side.

Ejemplo

uip gov aops-policy deployed-policy get Attended StudioX a1b2c3d4-0000-0000-0000-000000000100

Forma de datos (--json de salida)

{
  "Code": "AopsPolicyDeployedPolicyGet",
  "Data": { "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Baseline StudioX Policy", "data": { "allowAnalytics": true, "maxProjects": 5 } }
}

When no rule matches and there's no default, Data is { "Message": "No policy applies." } instead (the server's 204).

uip gov aops-policy deployed-policy list

Unlike get (top-priority effective policy only), returns every rule that applies to a (license type, product, tenant) for the calling user, in priority order — useful for understanding why a particular value wins. User-token only; S2S/impersonation isn't supported here.

Argumentos

Same three positional arguments as deployed-policy get.

Ejemplo

uip gov aops-policy deployed-policy list Attended StudioX a1b2c3d4-0000-0000-0000-000000000100

Forma de datos (--json de salida)

{
  "Code": "AopsPolicyDeployedPolicyList",
  "Data": [
    { "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Baseline StudioX Policy", "priority": 10, "source": "Tenant" },
    { "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000002", "name": "Restricted StudioX Policy", "priority": 20, "source": "User" }
  ]
}

Returns [] when no rules apply.

Relacionado

• uip gov — tool overview and Access Policies.
• aops-policy — policy CRUD, product/license-type catalogs, templates.
• compliance-packs — bundle policies into a named framework.

Ver también

• Herramientas (complementos)
• Opciones globales
• Códigos de salida