uip gov aops-policy deployment and deployed-policy

Syntax and options for assigning AOps governance policies to tenants, users, and groups, and for resolving the effective policy at runtime, using `uip gov aops-policy deployment` and `uip gov aops-policy deployed-policy`.

uip gov aops-policy deployment assigns AOps governance policies to governance subjects (tenants, users, groups); uip gov aops-policy deployed-policy resolves which policy actually applies at runtime after inheritance is walked. For authoring the policy records themselves, see aops-policy. For the parent tool overview, see uip gov.

Concepts

• Resolution order is user → group → tenant (user beats group beats tenant). A subject with no explicit assignment for a (product, license type) inherits from the next level up.
• null pins "No Policy" — passing null as a configure entry's policyIdentifier explicitly blocks inheritance from the level below, rather than leaving the entry unset (which inherits normally).
• Every configure verb is a full replace, not a merge. Entries omitted from the input file are removed from that subject's assignment list. To add one assignment while keeping others, start from that subject's get output, edit it, and resubmit the whole array.
• Scope differs per level: tenant assignments are scoped by (productIdentifier, licenseTypeIdentifier) — one policy per license type per product. User and group overrides are scoped by productIdentifier alone (not license-type-specific).
• Removing the last assignment on a tenant is refused, not silently ignored — the governance service treats saving an empty assignment array as a no-op, so deployment tenant remove explicitly errors rather than reporting success while leaving the assignment in place. Pin "policyIdentifier": null via configure instead.
• To verify what actually applies, use deployed-policy, not deployment ... get — the latter shows only explicit overrides at one level, not the resolved result.

Synopsis

uip gov aops-policy deployment tenant list [--product-name <name>] [--limit <n>] [--offset <n>]
uip gov aops-policy deployment tenant get <tenantIdentifier>
uip gov aops-policy deployment tenant configure <tenantIdentifier> --tenant-name <name> --input <path>
uip gov aops-policy deployment tenant remove <tenantIdentifier> --product-name <name> [--license-type <type>]

uip gov aops-policy deployment user list [--limit <n>] [--offset <n>]
uip gov aops-policy deployment user get <userIdentifier>
uip gov aops-policy deployment user configure <userIdentifier> --user <name> --input <path> [--source <source>] [--email <email>]
uip gov aops-policy deployment user delete <userIdentifier>

uip gov aops-policy deployment group list [--limit <n>] [--offset <n>]
uip gov aops-policy deployment group get <groupIdentifier>
uip gov aops-policy deployment group configure <groupIdentifier> --group <name> --input <path> [--source <source>]
uip gov aops-policy deployment group delete <groupIdentifier>

uip gov aops-policy deployed-policy get <license-type> <product-name> <tenantIdentifier> [--s2s-token <token> [--user-id <id> | --tenant-only]]
uip gov aops-policy deployed-policy list <license-type> <product-name> <tenantIdentifier>

Every verb also accepts --login-validity <minutes> (ignored on deployed-policy get when --s2s-token is set).

uip gov aops-policy deployment tenant

Baseline policy assignments per tenant, scoped by (productIdentifier, licenseTypeIdentifier). User and group assignments override these.

uip gov aops-policy deployment tenant list

Lists tenants registered in the governance system with their current assignments. Triggers an upstream sync from OMS before returning, so the result reflects the latest tenant catalog (new tenants, disabled/re-enabled state) — not just governance's local cache.

Options

Long	Value	Description
--product-name <product-name>	string	Return only tenants with an assignment for this product.
--limit <n>	integer	Page size. Default 20.
--offset <n>	integer	Zero-based page index.

Example

uip gov aops-policy deployment tenant list --product-name StudioX --limit 2

Data shape (--output json)

{
  "Code": "AopsPolicyDeploymentTenantList",
  "Data": [
    {
      "identifier": "a1b2c3d4-0000-0000-0000-000000000100",
      "name": "Acme Tenant",
      "tenantPolicies": [
        { "productIdentifier": "StudioX", "licenseTypeIdentifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }
      ]
    }
  ]
}

uip gov aops-policy deployment tenant get

Arguments

Name	Required	Purpose
<tenantIdentifier>	yes	Tenant GUID, from tenant list.

Example

uip gov aops-policy deployment tenant get a1b2c3d4-0000-0000-0000-000000000100

Data shape (--output json)

Same shape as one tenant list entry.

uip gov aops-policy deployment tenant configure

Replace a tenant's (product, license type) assignments from a JSON file. Full replace — entries not in the file are removed. Triggers an upstream OMS sync before saving, so a freshly-created (or status-changed) tenant is reconciled first.

Arguments

Name	Required	Purpose
<tenantIdentifier>	yes	Tenant GUID to configure.

Options

Long	Value	Required	Description
--tenant-name <tenantName>	string	yes	Display name — must match the tenant's name in the governance service.
--input <path>	path	yes	JSON array of {productIdentifier, licenseTypeIdentifier, policyIdentifier}. policyIdentifier: null pins "No Policy"; omit an entry to inherit normally.

Example

uip gov aops-policy deployment tenant configure a1b2c3d4-0000-0000-0000-000000000100 --tenant-name "Acme Tenant" --input tenant-policies.json

Data shape (--output json)

{
  "Code": "AopsPolicyDeploymentTenantConfigure",
  "Data": [
    { "productIdentifier": "StudioX", "licenseTypeIdentifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }
  ]
}

uip gov aops-policy deployment tenant remove

Remove a tenant's assignment(s) for a product without rewriting the full list yourself — a client-side read-filter-save.

Note:

Not atomic. This is read → filter → save; a concurrent change to the same tenant between the read and the save is lost. Avoid running concurrently against the same tenant. Cannot clear the last assignment — the service treats saving an empty array as a no-op, so this command refuses that case rather than reporting false success. Pin "policyIdentifier": null via configure instead.

Arguments

Name	Required	Purpose
<tenantIdentifier>	yes	Tenant GUID.

Options

Long	Value	Required	Description
--product-name <product-name>	string	yes	Product to unpin.
--license-type <license-type>	string	no	Narrow removal to one license type. Omit to remove every license-type entry for the product.

Fails with "No matching policy assignment to remove" if nothing matches.

Example

uip gov aops-policy deployment tenant remove a1b2c3d4-0000-0000-0000-000000000100 --product-name StudioX

Data shape (--output json)

{
  "Code": "AopsPolicyDeploymentTenantRemove",
  "Data": {
    "removed": [{ "productIdentifier": "StudioX", "licenseTypeIdentifier": "a1b2c3d4-0000-0000-0000-0000000000A1", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }],
    "tenantPolicies": []
  }
}

uip gov aops-policy deployment user

Per-user overrides, scoped by productIdentifier only (not license-type). User assignments win over group and tenant.

uip gov aops-policy deployment user list

Lists users the governance service has seen (assigned a policy to, or imported) — not a full identity-provider roster.

Options

Long	Value	Description
--limit <n>	integer	Page size. Default 20.
--offset <n>	integer	Zero-based page index.

Example

uip gov aops-policy deployment user list --limit 2

Data shape (--output json)

{ "Code": "AopsPolicyDeploymentUserList", "Data": [{ "identifier": "a1b2c3d4-0000-0000-0000-000000000201", "name": "[e-mail]", "source": "cloud" }] }

uip gov aops-policy deployment user get

Per-product overrides explicitly assigned to one user — tenant/group inheritance is not resolved here (use deployed-policy get for the effective value). Returns [] if the user has no overrides.

Arguments

Name	Required	Purpose
<userIdentifier>	yes	User GUID, from user list.

Example

uip gov aops-policy deployment user get a1b2c3d4-0000-0000-0000-000000000201

Data shape (--output json)

{ "Code": "AopsPolicyDeploymentUserGet", "Data": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }

uip gov aops-policy deployment user configure

Replace a user's per-product overrides. Auto-registers the user (via an add-user call) if not already known to governance; otherwise runs as a full-replace upsert.

Arguments

Name	Required	Purpose
<userIdentifier>	yes	User GUID to configure — from user list, or the upstream identity provider.

Options

Long	Value	Required	Description
--user <user>	string	yes	Display name stored alongside the override (surfaced in audit logs/UI).
--input <path>	path	yes	JSON array of {productIdentifier, policyIdentifier}. policyIdentifier: null pins "No Policy".
--source <source>	string	no	Identity-provider source (e.g. local, aad, cloud). Default local. Used only on the upsert path — first-time registration resolves source from CIS instead.
--email <email>	string	no	Email used only when registering a brand-new user. Ignored once the user is already known. Defaults to --user.

Example

uip gov aops-policy deployment user configure a1b2c3d4-0000-0000-0000-000000000201 --user [e-mail] --input user-policies.json

Data shape (--output json)

{
  "Code": "AopsPolicyDeploymentUserConfigure",
  "Data": { "identifier": "a1b2c3d4-0000-0000-0000-000000000201", "userPolicies": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }
}

uip gov aops-policy deployment user delete

Clear every per-product override for a user in one call — equivalent to configure with an empty array, without needing a JSON file. The user falls back to group/tenant inheritance for all products afterward.

Arguments

Name	Required	Purpose
<userIdentifier>	yes	User GUID, from user list.

Example

uip gov aops-policy deployment user delete a1b2c3d4-0000-0000-0000-000000000201

Data shape (--output json)

{ "Code": "AopsPolicyDeploymentUserDelete", "Data": { "Status": "Deleted", "identifier": "a1b2c3d4-0000-0000-0000-000000000201" } }

uip gov aops-policy deployment group

Per-group overrides, scoped by productIdentifier. Sits between user and tenant in resolution order (user wins over group, group wins over tenant). Verb shape is identical to deployment user (list/get/configure/delete) — only the subject differs.

uip gov aops-policy deployment group list

Options

Same as deployment user list (--limit, --offset).

Example

uip gov aops-policy deployment group list --limit 2

Data shape (--output json)

{ "Code": "AopsPolicyDeploymentGroupList", "Data": [{ "identifier": "a1b2c3d4-0000-0000-0000-000000000301", "name": "Engineering", "source": "cloud" }] }

uip gov aops-policy deployment group get

Arguments

Name	Required	Purpose
<groupIdentifier>	yes	Group GUID, from group list.

Data shape (--output json)

{ "Code": "AopsPolicyDeploymentGroupGet", "Data": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }

Returns [] when the group has no overrides.

uip gov aops-policy deployment group configure

Same shape and auto-registration behavior as deployment user configure, with --group <name> in place of --user <name> (no --email/--source semantics differ — --source here has the same default/meaning). Group members fall back to tenant inheritance for any product not in the input file.

Arguments

Name	Required	Purpose
<groupIdentifier>	yes	Group GUID to configure.

Options

Long	Value	Required	Description
--group <group>	string	yes	Display name stored alongside the override.
--input <path>	path	yes	JSON array of {productIdentifier, policyIdentifier}.
--source <source>	string	no	Identity-provider source. Default local.

Example

uip gov aops-policy deployment group configure a1b2c3d4-0000-0000-0000-000000000301 --group Engineering --input group-policies.json

Data shape (--output json)

{
  "Code": "AopsPolicyDeploymentGroupConfigure",
  "Data": { "identifier": "a1b2c3d4-0000-0000-0000-000000000301", "groupPolicies": [{ "productIdentifier": "StudioX", "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001" }] }
}

uip gov aops-policy deployment group delete

Removes the group and all its policy overrides from governance. The group itself remains in the upstream identity provider — this only clears governance state. Members fall back to user-level or tenant-level assignments.

Arguments

Name	Required	Purpose
<groupIdentifier>	yes	Group GUID, from group list.

Data shape (--output json)

{ "Code": "AopsPolicyDeploymentGroupDelete", "Data": { "Status": "Deleted", "identifier": "a1b2c3d4-0000-0000-0000-000000000301" } }

uip gov aops-policy deployed-policy

Read-only. Resolves the single effective policy for a subject after inheritance is walked — the answer to "what actually applies right now."

uip gov aops-policy deployed-policy get

Arguments

Name	Required	Purpose
<license-type>	yes	License type name (e.g. Attended) — from license-type list.
<product-name>	yes	Product name (e.g. StudioX) — from product list.
<tenantIdentifier>	yes	Tenant GUID — from deployment tenant list.

Options

Long	Value	Description
--s2s-token <token>	string	Service-to-service bearer token, overriding the user token for this call only. Prefer the UIP_S2S_TOKEN environment variable over this flag — a CLI-argument token is visible in process listings (ps aux, /proc/*/cmdline).
--user-id <userId>	string	Resolve the effective policy for this specific user (full user→group→tenant walk). Requires an S2S token. Mutually exclusive with --tenant-only.
--tenant-only	flag	Resolve the tenant-level policy only, ignoring user/group overrides. Requires an S2S token. Mutually exclusive with --user-id.

Three resolution modes: default (caller's own user token, resolves for the caller), S2S + --user-id (resolve for a specific user), S2S + --tenant-only (tenant-level only). --user-id/--tenant-only without an S2S token fails client-side.

Example

uip gov aops-policy deployed-policy get Attended StudioX a1b2c3d4-0000-0000-0000-000000000100

Data shape (--output json)

{
  "Code": "AopsPolicyDeployedPolicyGet",
  "Data": { "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Baseline StudioX Policy", "data": { "allowAnalytics": true, "maxProjects": 5 } }
}

When no rule matches and there's no default, Data is { "Message": "No policy applies." } instead (the server's 204).

uip gov aops-policy deployed-policy list

Unlike get (top-priority effective policy only), returns every rule that applies to a (license type, product, tenant) for the calling user, in priority order — useful for understanding why a particular value wins. User-token only; S2S/impersonation isn't supported here.

Arguments

Same three positional arguments as deployed-policy get.

Example

uip gov aops-policy deployed-policy list Attended StudioX a1b2c3d4-0000-0000-0000-000000000100

Data shape (--output json)

{
  "Code": "AopsPolicyDeployedPolicyList",
  "Data": [
    { "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Baseline StudioX Policy", "priority": 10, "source": "Tenant" },
    { "policyIdentifier": "a1b2c3d4-0000-0000-0000-000000000002", "name": "Restricted StudioX Policy", "priority": 20, "source": "User" }
  ]
}

Returns [] when no rules apply.

Related

• uip gov — tool overview and Access Policies.
• aops-policy — policy CRUD, product/license-type catalogs, templates.
• compliance-packs — bundle policies into a named framework.

See also

• Tools (plugins)
• Global options
• Exit codes