# noust access

Roles, and where each person holds them.

```bash
noust access [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`grant`](#noust-access-grant), [`list`](#noust-access-list), [`permissions`](#noust-access-permissions), [`revoke`](#noust-access-revoke), [`role`](#noust-access-role)

## noust access grant

Give an account a role at a scope.

```bash
noust access grant [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `--role` | A built-in team role or one you defined. |  |
| `--team` | The team. |  |
| `--project` | The project of that team. |  |
| `--env` | The environment of that project. |  |
| `--scope` | Where; the narrowest of --team, --project and --env by default. 'instance' is the whole server: one more role of the account, as 'noust user roles' sets them. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust access list

List who holds a role where, besides each account's own role and team memberships.

```bash
noust access list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--user` | Only this account's. |  |
| `--team` | Only what is held in this team. |  |
| `--json` | Print the bindings as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust access permissions

List every permission a role can hold, and what it allows.

```bash
noust access permissions [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the permissions as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust access revoke

Take a role away, by the id 'noust access list' shows.

```bash
noust access revoke [OPTIONS] BINDING_ID
```

Arguments: `binding_id`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust access role

Define roles of your own, as sets of permissions.

```bash
noust access role [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`create`](#noust-access-role-create), [`duplicate`](#noust-access-role-duplicate), [`list`](#noust-access-role-list), [`offers`](#noust-access-role-offers), [`remove`](#noust-access-role-remove), [`reset`](#noust-access-role-reset), [`set`](#noust-access-role-set), [`show`](#noust-access-role-show)

## noust access role create

Define a role.

```bash
noust access role create [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--permission` | A permission the role holds (repeat). 'noust access permissions' lists them. |  |
| `--label` | What the console shows; the name by default. |  |
| `--description` | What the role is for. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust access role duplicate

Copy a role into a role of your own, which you then change as you like.

```bash
noust access role duplicate [OPTIONS] NAME NEW_NAME
```

Arguments: `name`, `new_name`

| Option | What it does | Default |
|---|---|---|
| `--label` | Its label; the original's by default. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust access role list

List the server's roles, and a team's built-in ones.

```bash
noust access role list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the roles as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust access role offers

Take or leave what a newer release ships for a role you edited.

```bash
noust access role offers [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--accept` | An offered permission to add (repeat). |  |
| `--dismiss` | An offered permission to leave out (repeat). |  |
| `--json` | Print the role as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust access role remove

Remove a role of your own that nobody holds.

```bash
noust access role remove [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust access role reset

Put a role Noust ships back to how it comes: it follows the release again.

```bash
noust access role reset [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust access role set

Change a role, one Noust ships included; everyone who holds it holds the change.

```bash
noust access role set [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--permission` | Replace its permissions (repeat). |  |
| `--label` | Its new label. |  |
| `--description` | Its new description. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust access role show

Show what a role holds, permission by permission, and who holds it.

```bash
noust access role show [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the role as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |