murmur check-permissions

Evaluates permissions against the caller’s effective grants. Each positional argument is a permission string in {kind}.{verb} format. The command prints a table showing whether each permission is granted or denied, and exits non-zero if any check is denied. Use this to verify what the current identity is allowed to do before attempting an operation, or to debug authorization issues.

Synopsis

murmur check-permissions [flags] <kind.verb> [kind.verb ...]

Arguments

Name	Type	Required	Description
`kind.verb`	string	yes	One or more permissions to check, each in `{kind}.{verb}` format (e.g. `agent.read`, `secret.edit`).
`--resource`	string	no	Catalog resource ref in `{kind}/{name}` format, applied to all checks. Must appear before the first `kind.verb` argument.

Output

A tab-aligned table with one row per permission checked:

Column	Description
`PERMISSION`	The permission string that was evaluated.
`GRANTED`	`yes` if the caller has this permission, `no` if denied.
`REASON`	Explanation of why the permission was granted or denied.

The command exits with a non-zero status if any permission is denied.

Examples

Check multiple permissions

murmur check-permissions agent.read agent.list agent.delete

PERMISSION      GRANTED  REASON
agent.read      yes      granted by role "developer"
agent.list      yes      granted by role "developer"
agent.delete    no       no matching grant

Check a permission against a specific resource

Flags are parsed only up to the first positional argument, so --resource goes before the permissions:

murmur check-permissions --resource agent/my-task agent.edit

PERMISSION    GRANTED  REASON
agent.edit    yes      granted by role "developer"

Errors

Code	Meaning	What to do
`INVALID_ARGUMENT`	A positional argument is not in `{kind}.{verb}` format, or `--resource` is not in `{kind}/{name}` format.	Fix the argument format and retry.
`unexpected flag "--resource": flags must come before positional arguments`	A flag was written after a permission.	Move every flag ahead of the first `kind.verb` argument.
`UNAUTHENTICATED`	Identity token is missing or expired.	Run `murmur auth` or check your `murmur.local.yaml` configuration.
non-zero exit	One or more permissions were denied.	Review the output table to see which permissions were denied and why.

Authorization — how the authorization system evaluates grants
Permissions guide — understanding permission strings and roles
murmur status — query an agent’s current status

Getting Started

Core Concepts

Guides

murmur check-permissions

Synopsis

Arguments

Output

Examples

Check multiple permissions

Check a permission against a specific resource

Errors

​Synopsis

​Arguments

​Output

​Examples

​Check multiple permissions

​Check a permission against a specific resource

​Errors

​Related

Synopsis

Arguments

Output

Examples

Check multiple permissions

Check a permission against a specific resource

Errors

Related