A command library composed by admin-tool — it owns no uip verb of its own. It registers its commands under a single authorization subject group, so users invoke them as uip admin authorization <subject> <verb>.

Command tree

uip admin authorization
├── roles
│   ├── list [--limit] [--offset] [--filter] [--service] [--scope-type] [--role-type] [--tenant-id <guid>]
│   ├── get <id>
│   ├── create --file <path>
│   ├── update <id> --file <path>
│   ├── delete <id>
│   └── assignments
│       ├── list [--limit] [--offset] [--service] [--identity-id]
│       ├── create --file <path>      # JSON array of AddRoleAssignmentRequest
│       └── delete --file <path>      # JSON array of assignment-id strings
├── permissions
│   └── list [--service] [--scope-type]
└── check-access [--file <path> | --identity-id <guid> --scope-type <Tenant|Folder> --scope-id <guid> [--parent-folder-id <guid>]]

Subjects

roles — custom role CRUD on the Policy Administration Point (PAP), with one nested group:
- roles assignments — list / create / delete who-has-what-role.
permissions list — read-only catalog of permission definitions.
check-access — compute the effective permissions a security principal has within a tenant or folder scope, via the Policy Decision Point (PDP).

Policy CRUD

Policy management (policies list/get/create/update/delete/evaluate) lives under uip gov access-policy …, not here, even though both tools target the same authz-sdk swagger. This split keeps the existing uip gov namespace stable.

Conventions

Authenticated via uip login.
Mutating commands (and most query commands) take --file <path> carrying the matching SDK request DTO as JSON.
assignments create expects an array of AddRoleAssignmentRequest objects; the tool wraps it as {roleAssignmentsToAdd: [...], roleAssignmentsToDelete: []} and POSTs to the bulk-update endpoint.
assignments delete expects an array of assignment-id strings; the tool wraps it as {roleAssignmentsToAdd: [], roleAssignmentsToDelete: [...]} and POSTs to the same endpoint.
check-access bypasses the SDK method because the source swagger does not declare a requestBody; the tool POSTs directly via the SDK's resolved Configuration.basePath and bearer token.