People and access

aertun auth grant sam@example.com analyst
aertun auth grant lee@example.com engineer --for 30d
aertun auth deny sam@example.com responder --on /security/vulns
aertun auth explain sam@example.com respond
aertun auth list

explain walks every binding and says which one decided, and why the others did not. See Roles for what each role may do.

Provisioning with SCIM#

aertun scim token
aertun scim map security-analysts analyst
aertun scim status

The identity provider adds, changes and removes people; a group is mapped to a role or a job.

Tokens#

aertun token issue ci --principal ci-bot
aertun token list
aertun token revoke ID
aertun token stale

A token is shown once and stored only as a hash. An administrator's token takes a second administrator.