group

A group is a catalog resource that collects users into a named set. Tenant-bindings reference groups to grant permissions to every member at once: instead of listing individual users in each binding, you manage membership in one place. Exactly one source type must be set: static, github_admin, all_tenant_members, or agent_runtime.

Fields

Name	Type	Required	Description
`name`	string	yes	Unique identifier. DNS label format: `[a-z][a-z0-9-]{0,62}`. Names prefixed `murmur-` are reserved for platform builtins.
`description`	string	no	Human-readable description shown in the dashboard. Maximum 1024 bytes.
`source`	oneof	yes	How membership is determined. Exactly one of `static`, `github_admin`, `all_tenant_members`, or `agent_runtime`.

Source: `static`

A hand-managed list of GitHub usernames.

Name	Type	Required	Description
`static.members`	string[]	yes	GitHub usernames in this group. At least one member is required. No duplicates.

Source: `github_admin`

Resolves to the owners of the GitHub organization linked to the tenant. No additional fields.

Name	Type	Required	Description
`github_admin`	object	yes	Empty object. Membership is resolved automatically from org owners.

Source: `all_tenant_members`

Resolves to every authenticated member of the tenant. Reserved for platform builtins.

Name	Type	Required	Description
`all_tenant_members`	object	yes	Empty object. Membership includes all tenant members.

Source: `agent_runtime`

Resolves to every agent-runtime caller in the tenant: the per-agent identity each agent VM uses. Reserved for platform builtins: a group with this source must have a murmur- name, and only a platform-builtin tenant-binding may grant to it.

Name	Type	Required	Description
`agent_runtime`	object	yes	Empty object. Membership is every agent-runtime caller in the tenant.

all_tenant_members and agent_runtime are reserved for platform-managed groups. Tenant-authored groups use static or github_admin.

Examples

Static group

name: platform-team
description: "Core platform engineers"
static:
  members:
    - alice
    - bob
    - carol

cat <<'EOF' | murmur set group platform-team
name: platform-team
description: "Core platform engineers"
static:
  members:
    - alice
    - bob
    - carol
EOF

GitHub admin group

name: org-admins
description: "GitHub organization owners"
github_admin: {}

cat <<'EOF' | murmur set group org-admins
name: org-admins
description: "GitHub organization owners"
github_admin: {}
EOF

Listing groups

murmur get group

org-admins
platform-team

The list prints one name per line, with no header.

Reading a single group

murmur get group platform-team

Errors

Code	Meaning	What to do
`INVALID_ARGUMENT`	`name is required`	Provide a `name` field.
`INVALID_ARGUMENT`	`name must match [a-z][a-z0-9-]{0,62}`	Use a valid DNS label: lowercase letters, digits, and hyphens. Must start with a letter.
`INVALID_ARGUMENT`	`description exceeds 1024 byte limit`	Shorten the `description` to 1024 bytes or fewer.
`INVALID_ARGUMENT`	`group source is required (static, github_admin, or all_tenant_members)`	Set exactly one of `static`, `github_admin`, or `all_tenant_members`.
`INVALID_ARGUMENT`	`agent_runtime group source is reserved for platform builtins`	Use `static` or `github_admin`.
`INVALID_ARGUMENT`	`static group must have at least one member`	Add at least one username to `static.members`.
`INVALID_ARGUMENT`	`static.members[N] must be non-empty`	A member entry is an empty string. Provide a GitHub username.
`INVALID_ARGUMENT`	`static.members[N]: duplicate member "username"`	Remove the duplicate username from `static.members`.
`FAILED_PRECONDITION`	`cannot delete group "name": referenced by tenant-binding: binding-name`	Remove the tenant-binding that references this group before deleting it.

Role: named permission bundle that a tenant-binding can reference
Tenant-binding: grants permissions to groups and users
Permissions: guide to the permission model
murmur set: CLI command for creating and updating catalog resources
murmur get: CLI command for reading catalog resources

Getting Started

Core Concepts

Guides

Fields

Source: `static`

Source: `github_admin`

Source: `all_tenant_members`

Source: `agent_runtime`

Examples

Static group

GitHub admin group

Listing groups

Reading a single group

Errors

​Fields

​Source: static

​Source: github_admin

​Source: all_tenant_members

​Source: agent_runtime

​Examples

​Static group

​GitHub admin group

​Listing groups

​Reading a single group

​Errors

​Related

Fields

Source: `static`

Source: `github_admin`

Source: `all_tenant_members`

Source: `agent_runtime`

Examples

Static group

GitHub admin group

Listing groups

Reading a single group

Errors

Related