uip gov aops-policy deployment and deployed-policy

Syntax and options for assigning AOps governance policies to tenants, users, and groups, and for resolving the effective policy at runtime, using `uip gov aops-policy deployment` and `uip gov aops-policy deployed-policy`.

uip gov aops-policy deployment assigns AOps governance policies to governance subjects (tenants, users, groups); uip gov aops-policy deployed-policy resolves which policy actually applies at runtime after inheritance is walked. For authoring the policy records themselves, see aops-policy. For the parent tool overview, see uip gov.

概念

• Resolution order is user → group → tenant (user beats group beats tenant). A subject with no explicit assignment for a (product, license type) inherits from the next level up.
• null pins "No Policy" — passing null as a configure entry's policyIdentifier explicitly blocks inheritance from the level below, rather than leaving the entry unset (which inherits normally).
• Every configure verb is a full replace, not a merge. Entries omitted from the input file are removed from that subject's assignment list. To add one assignment while keeping others, start from that subject's get output, edit it, and resubmit the whole array.
• Scope differs per level: tenant assignments are scoped by (productIdentifier, licenseTypeIdentifier) — one policy per license type per product. User and group overrides are scoped by productIdentifier alone (not license-type-specific).
• Removing the last assignment on a tenant is refused, not silently ignored — the governance service treats saving an empty assignment array as a no-op, so deployment tenant remove explicitly errors rather than reporting success while leaving the assignment in place. Pin "policyIdentifier": null via configure instead.
• To verify what actually applies, use deployed-policy, not deployment ... get — the latter shows only explicit overrides at one level, not the resolved result.

概要

uip gov aops-policy deployment tenant list [--product-name <name>] [--limit <n>] [--offset <n>]
uip gov aops-policy deployment tenant get <tenantIdentifier>
uip gov aops-policy deployment tenant configure <tenantIdentifier> --tenant-name <name> --input <path>
uip gov aops-policy deployment tenant remove <tenantIdentifier> --product-name <name> [--license-type <type>]

uip gov aops-policy deployment user list [--limit <n>] [--offset <n>]
uip gov aops-policy deployment user get <userIdentifier>
uip gov aops-policy deployment user configure <userIdentifier> --user <name> --input <path> [--source <source>] [--email <email>]
uip gov aops-policy deployment user delete <userIdentifier>

uip gov aops-policy deployment group list [--limit <n>] [--offset <n>]
uip gov aops-policy deployment group get <groupIdentifier>
uip gov aops-policy deployment group configure <groupIdentifier> --group <name> --input <path> [--source <source>]
uip gov aops-policy deployment group delete <groupIdentifier>

uip gov aops-policy deployed-policy get <license-type> <product-name> <tenantIdentifier> [--s2s-token <token> [--user-id <id> | --tenant-only]]
uip gov aops-policy deployed-policy list <license-type> <product-name> <tenantIdentifier>

Every verb also accepts --login-validity <minutes> (ignored on deployed-policy get when --s2s-token is set).

uip gov aops-policy deployment tenant

Baseline policy assignments per tenant, scoped by (productIdentifier, licenseTypeIdentifier). User and group assignments override these.

uip gov aops-policy deployment tenant list

Lists tenants registered in the governance system with their current assignments. Triggers an upstream sync from OMS before returning, so the result reflects the latest tenant catalog (new tenants, disabled/re-enabled state) — not just governance's local cache.

オプション

長押し	値 (Value)	説明
--product-name <product-name>	string	Return only tenants with an assignment for this product.
--limit <n>	integer	Page size. Default 20.
--offset <n>	integer	Zero-based page index.

例

uip gov aops-policy deployment tenant list --product-name StudioX --limit 2

データシェイプ(--output json)

{
  "Code": "AopsPolicyDeploymentTenantList",
  "Data": [
    {
      "identifier": "a1b2c3d4-0000-0000-0000-000000000100",
      "name": "Acme Tenant",
      "tenantPolicies": [
        { "productIdentifier": "StudioX", "licenseTypeIdentifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }
      ]
    }
  ]
}

uip gov aops-policy deployment tenant get

引数

名前	Required	目的
<tenantIdentifier>	○	Tenant GUID, from tenant list.

例

uip gov aops-policy deployment tenant get a1b2c3d4-0000-0000-0000-000000000100

データシェイプ(--output json)

Same shape as one tenant list entry.

uip gov aops-policy deployment tenant configure

Replace a tenant's (product, license type) assignments from a JSON file. Full replace — entries not in the file are removed. Triggers an upstream OMS sync before saving, so a freshly-created (or status-changed) tenant is reconciled first.

引数

名前	Required	目的
<tenantIdentifier>	○	Tenant GUID to configure.

オプション

長押し	値 (Value)	Required	説明
--tenant-name <tenantName>	string	○	Display name — must match the tenant's name in the governance service.
--input <path>	パス	○	JSON array of {productIdentifier, licenseTypeIdentifier, policyIdentifier}. policyIdentifier: null pins "No Policy"; omit an entry to inherit normally.

例

uip gov aops-policy deployment tenant configure a1b2c3d4-0000-0000-0000-000000000100 --tenant-name "Acme Tenant" --input tenant-policies.json

データシェイプ(--output json)

{
  "Code": "AopsPolicyDeploymentTenantConfigure",
  "Data": [
    { "productIdentifier": "StudioX", "licenseTypeIdentifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }
  ]
}

uip gov aops-policy deployment tenant remove

Remove a tenant's assignment(s) for a product without rewriting the full list yourself — a client-side read-filter-save.

注:

Not atomic. This is read → filter → save; a concurrent change to the same tenant between the read and the save is lost. Avoid running concurrently against the same tenant. Cannot clear the last assignment — the service treats saving an empty array as a no-op, so this command refuses that case rather than reporting false success. Pin "policyIdentifier": null via configure instead.

引数

名前	Required	目的
<tenantIdentifier>	○	Tenant GUID.

オプション

長押し	値 (Value)	Required	説明
--product-name <product-name>	string	○	Product to unpin.
--license-type <license-type>	string	×	Narrow removal to one license type. Omit to remove every license-type entry for the product.

Fails with "No matching policy assignment to remove" if nothing matches.

例

uip gov aops-policy deployment tenant remove a1b2c3d4-0000-0000-0000-000000000100 --product-name StudioX

データシェイプ(--output json)

{
  "Code": "AopsPolicyDeploymentTenantRemove",
  "Data": {
    "removed": [{ "productIdentifier": "StudioX", "licenseTypeIdentifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }],
    "tenantPolicies": []
  }
}

uip gov aops-policy deployment user

Per-user overrides, scoped by productIdentifier only (not license-type). User assignments win over group and tenant.

uip gov aops-policy deployment user list

Lists users the governance service has seen (assigned a policy to, or imported) — not a full identity-provider roster.

オプション

長押し	値 (Value)	説明
--limit <n>	integer	Page size. Default 20.
--offset <n>	integer	Zero-based page index.

例

uip gov aops-policy deployment user list --limit 2

データシェイプ(--output json)

{ "Code": "AopsPolicyDeploymentUserList", "Data": [{ "identifier": "a1b2c3d4-0000-0000-0000-000000000201", "name": "[e-mail]", "source": "cloud" }] }

uip gov aops-policy deployment user get

Per-product overrides explicitly assigned to one user — tenant/group inheritance is not resolved here (use deployed-policy get for the effective value). Returns [] if the user has no overrides.

引数

名前	Required	目的
<userIdentifier>	○	User GUID, from user list.

例

uip gov aops-policy deployment user get a1b2c3d4-0000-0000-0000-000000000201

データシェイプ(--output json)

{ "Code": "AopsPolicyDeploymentUserGet", "Data": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }

uip gov aops-policy deployment user configure

Replace a user's per-product overrides. Auto-registers the user (via an add-user call) if not already known to governance; otherwise runs as a full-replace upsert.

引数

名前	Required	目的
<userIdentifier>	○	User GUID to configure — from user list, or the upstream identity provider.

オプション

長押し	値 (Value)	Required	説明
--user <user>	string	○	Display name stored alongside the override (surfaced in audit logs/UI).
--input <path>	パス	○	JSON array of {productIdentifier, policyIdentifier}. policyIdentifier: null pins "No Policy".
--source <source>	string	×	Identity-provider source (e.g. local, aad, cloud). Default local. Used only on the upsert path — first-time registration resolves source from CIS instead.
--email <email>	string	×	Email used only when registering a brand-new user. Ignored once the user is already known. Defaults to --user.

例

uip gov aops-policy deployment user configure a1b2c3d4-0000-0000-0000-000000000201 --user [e-mail] --input user-policies.json

データシェイプ(--output json)

{
  "Code": "AopsPolicyDeploymentUserConfigure",
  "Data": { "identifier": "a1b2c3d4-0000-0000-0000-000000000201", "userPolicies": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }
}

uip gov aops-policy deployment user delete

Clear every per-product override for a user in one call — equivalent to configure with an empty array, without needing a JSON file. The user falls back to group/tenant inheritance for all products afterward.

引数

名前	Required	目的
<userIdentifier>	○	User GUID, from user list.

例

uip gov aops-policy deployment user delete a1b2c3d4-0000-0000-0000-000000000201

データシェイプ(--output json)

{ "Code": "AopsPolicyDeploymentUserDelete", "Data": { "Status": "Deleted", "identifier": "a1b2c3d4-0000-0000-0000-000000000201" } }

uip gov aops-policy deployment group

Per-group overrides, scoped by productIdentifier. Sits between user and tenant in resolution order (user wins over group, group wins over tenant). Verb shape is identical to deployment user (list/get/configure/delete) — only the subject differs.

uip gov aops-policy deployment group list

オプション

Same as deployment user list (--limit, --offset).

例

uip gov aops-policy deployment group list --limit 2

データシェイプ(--output json)

{ "Code": "AopsPolicyDeploymentGroupList", "Data": [{ "identifier": "a1b2c3d4-0000-0000-0000-000000000301", "name": "Engineering", "source": "cloud" }] }

uip gov aops-policy deployment group get

引数

名前	Required	目的
<groupIdentifier>	○	Group GUID, from group list.

データシェイプ(--output json)

{ "Code": "AopsPolicyDeploymentGroupGet", "Data": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }

Returns [] when the group has no overrides.

uip gov aops-policy deployment group configure

Same shape and auto-registration behavior as deployment user configure, with --group <name> in place of --user <name> (no --email/--source semantics differ — --source here has the same default/meaning). Group members fall back to tenant inheritance for any product not in the input file.

引数

名前	Required	目的
<groupIdentifier>	○	Group GUID to configure.

オプション

長押し	値 (Value)	Required	説明
--group <group>	string	○	Display name stored alongside the override.
--input <path>	パス	○	JSON array of {productIdentifier, policyIdentifier}.
--source <source>	string	×	Identity-provider source. Default local.

例

uip gov aops-policy deployment group configure a1b2c3d4-0000-0000-0000-000000000301 --group Engineering --input group-policies.json

データシェイプ(--output json)

{
  "Code": "AopsPolicyDeploymentGroupConfigure",
  "Data": { "identifier": "a1b2c3d4-0000-0000-0000-000000000301", "groupPolicies": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }
}

uip gov aops-policy deployment group delete

Removes the group and all its policy overrides from governance. The group itself remains in the upstream identity provider — this only clears governance state. Members fall back to user-level or tenant-level assignments.

引数

名前	Required	目的
<groupIdentifier>	○	Group GUID, from group list.

データシェイプ(--output json)

{ "Code": "AopsPolicyDeploymentGroupDelete", "Data": { "Status": "Deleted", "identifier": "a1b2c3d4-0000-0000-0000-000000000301" } }

uip gov aops-policy deployed-policy

Read-only. Resolves the single effective policy for a subject after inheritance is walked — the answer to "what actually applies right now."

uip gov aops-policy deployed-policy get

引数

名前	Required	目的
<license-type>	○	License type name (e.g. Attended) — from license-type list.
<product-name>	○	Product name (e.g. StudioX) — from product list.
<tenantIdentifier>	○	Tenant GUID — from deployment tenant list.

オプション

長押し	値 (Value)	説明
--s2s-token <token>	string	Service-to-service bearer token, overriding the user token for this call only. Prefer the UIP_S2S_TOKEN environment variable over this flag — a CLI-argument token is visible in process listings (ps aux, /proc/*/cmdline).
--user-id <userId>	string	Resolve the effective policy for this specific user (full user→group→tenant walk). Requires an S2S token. Mutually exclusive with --tenant-only.
--tenant-only	フラグ	Resolve the tenant-level policy only, ignoring user/group overrides. Requires an S2S token. Mutually exclusive with --user-id.

Three resolution modes: default (caller's own user token, resolves for the caller), S2S + --user-id (resolve for a specific user), S2S + --tenant-only (tenant-level only). --user-id/--tenant-only without an S2S token fails client-side.

例

uip gov aops-policy deployed-policy get Attended StudioX a1b2c3d4-0000-0000-0000-000000000100

データシェイプ(--output json)

{
  "Code": "AopsPolicyDeployedPolicyGet",
  "Data": { "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Baseline StudioX Policy", "data": { "allowAnalytics": true, "maxProjects": 5 } }
}

When no rule matches and there's no default, Data is { "Message": "No policy applies." } instead (the server's 204).

uip gov aops-policy deployed-policy list

Unlike get (top-priority effective policy only), returns every rule that applies to a (license type, product, tenant) for the calling user, in priority order — useful for understanding why a particular value wins. User-token only; S2S/impersonation isn't supported here.

引数

Same three positional arguments as deployed-policy get.

例

uip gov aops-policy deployed-policy list Attended StudioX a1b2c3d4-0000-0000-0000-000000000100

データシェイプ(--output json)

{
  "Code": "AopsPolicyDeployedPolicyList",
  "Data": [
    { "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Baseline StudioX Policy", "priority": 10, "source": "Tenant" },
    { "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000002", "name": "Restricted StudioX Policy", "priority": 20, "source": "User" }
  ]
}

Returns [] when no rules apply.

関連

• uip gov — tool overview and Access Policies.
• aops-policy — policy CRUD, product/license-type catalogs, templates.
• compliance-packs — bundle policies into a named framework.

参照

• ツール (プラグイン)
• グローバル オプション
• 終了コード