[{"data":1,"prerenderedAt":553},["ShallowReactive",2],{"navigation":3,"\u002Fadministration\u002Faccess":194,"\u002Fadministration\u002Faccess-surround":548},[4,18,31,64,81,102,111,132,149],{"title":5,"path":6,"stem":7,"children":8,"page":17},"Getting started","\u002Fgetting-started","1.getting-started",[9,13],{"title":10,"path":11,"stem":12},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction",{"title":14,"path":15,"stem":16},"Run your first workflow","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F2.quickstart",false,{"title":19,"path":20,"stem":21,"children":22,"page":17},"Core concepts","\u002Fconcepts","2.concepts",[23,27],{"title":24,"path":25,"stem":26},"The platform model","\u002Fconcepts\u002Fplatform","2.concepts\u002F1.platform",{"title":28,"path":29,"stem":30},"Architecture and boundaries","\u002Fconcepts\u002Farchitecture","2.concepts\u002F2.architecture",{"title":32,"path":33,"stem":34,"children":35,"page":17},"Installation","\u002Finstallation","3.installation",[36,40,44,48,52,56,60],{"title":37,"path":38,"stem":39},"Overview and requirements","\u002Finstallation\u002Foverview","3.installation\u002F1.overview",{"title":41,"path":42,"stem":43},"Local evaluation","\u002Finstallation\u002Flocal-evaluation","3.installation\u002F2.local-evaluation",{"title":45,"path":46,"stem":47},"Install the server","\u002Finstallation\u002Fserver","3.installation\u002F3.server",{"title":49,"path":50,"stem":51},"Install a runner","\u002Finstallation\u002Frunner","3.installation\u002F4.runner",{"title":53,"path":54,"stem":55},"Verify the installation","\u002Finstallation\u002Fverification","3.installation\u002F5.verification",{"title":57,"path":58,"stem":59},"Upgrade the platform","\u002Finstallation\u002Fupgrades","3.installation\u002F6.upgrades",{"title":61,"path":62,"stem":63},"Guided installer","\u002Finstallation\u002Finstaller","3.installation\u002F7.installer",{"title":65,"path":66,"stem":67,"children":68,"page":17},"Build workflows","\u002Fworkflows","4.workflows",[69,73,77],{"title":70,"path":71,"stem":72},"Build a Definition","\u002Fworkflows\u002Fdefinitions","4.workflows\u002F0.definitions",{"title":74,"path":75,"stem":76},"Deploy and run workflows","\u002Fworkflows\u002Fruns","4.workflows\u002F1.runs",{"title":78,"path":79,"stem":80},"Inputs, context, and secrets","\u002Fworkflows\u002Finputs-and-secrets","4.workflows\u002F2.inputs-and-secrets",{"title":82,"path":83,"stem":84,"children":85,"page":17},"Run and recover","\u002Foperations","5.operations",[86,90,94,98],{"title":87,"path":88,"stem":89},"Monitor Runs","\u002Foperations\u002Fmonitoring","5.operations\u002F1.monitoring",{"title":91,"path":92,"stem":93},"Approve prepared steps","\u002Foperations\u002Fapprovals","5.operations\u002F2.approvals",{"title":95,"path":96,"stem":97},"Recover or cancel execution","\u002Foperations\u002Frecovery","5.operations\u002F3.recovery",{"title":99,"path":100,"stem":101},"Troubleshooting","\u002Foperations\u002Ftroubleshooting","5.operations\u002F4.troubleshooting",{"title":103,"path":104,"stem":105,"children":106,"page":17},"Action catalog","\u002Fcatalog","6.catalog",[107],{"title":108,"path":109,"stem":110},"Find and use Actions","\u002Fcatalog\u002Foverview","6.catalog\u002F1.overview",{"title":112,"path":113,"stem":114,"children":115,"page":17},"Administration","\u002Fadministration","7.administration",[116,120,124,128],{"title":117,"path":118,"stem":119},"Registries and Environments","\u002Fadministration\u002Fenvironments","7.administration\u002F2.environments",{"title":121,"path":122,"stem":123},"Manage runners","\u002Fadministration\u002Frunners","7.administration\u002F3.runners",{"title":125,"path":126,"stem":127},"Access and approval policies","\u002Fadministration\u002Faccess","7.administration\u002F4.access",{"title":129,"path":130,"stem":131},"Backups and upgrades","\u002Fadministration\u002Fmaintenance","7.administration\u002F5.maintenance",{"title":133,"path":134,"stem":135,"children":136,"page":17},"Develop Actions","\u002Factions","8.actions",[137,141,145],{"title":138,"path":139,"stem":140},"Build your first Action","\u002Factions\u002Fquickstart","8.actions\u002F1.quickstart",{"title":142,"path":143,"stem":144},"Local development","\u002Factions\u002Flocal-development","8.actions\u002F2.local-development",{"title":146,"path":147,"stem":148},"Publish an Action","\u002Factions\u002Fpublishing","8.actions\u002F3.publishing",{"title":150,"path":151,"stem":152,"children":153,"page":17},"Reference","\u002Freference","9.reference",[154,158,162,166,170,174,178,182,186,190],{"title":155,"path":156,"stem":157},"Operator CLI","\u002Freference\u002Foperator-cli","9.reference\u002F1.operator-cli",{"title":159,"path":160,"stem":161},"Installer CLI","\u002Freference\u002Finstaller-cli","9.reference\u002F10.installer-cli",{"title":163,"path":164,"stem":165},"Definition syntax","\u002Freference\u002Fdefinition","9.reference\u002F2.definition",{"title":167,"path":168,"stem":169},"CLI configuration","\u002Freference\u002Fconfiguration","9.reference\u002F3.configuration",{"title":171,"path":172,"stem":173},"API integration","\u002Freference\u002Fapi","9.reference\u002F4.api",{"title":175,"path":176,"stem":177},"Action CLI","\u002Freference\u002Faction-cli","9.reference\u002F5.action-cli",{"title":179,"path":180,"stem":181},"Action SDK","\u002Freference\u002Fsdk","9.reference\u002F6.sdk",{"title":183,"path":184,"stem":185},"Contracts and compatibility","\u002Freference\u002Fcontracts","9.reference\u002F7.contracts",{"title":187,"path":188,"stem":189},"Server configuration","\u002Freference\u002Fserver-configuration","9.reference\u002F8.server-configuration",{"title":191,"path":192,"stem":193},"Runner configuration","\u002Freference\u002Frunner-configuration","9.reference\u002F9.runner-configuration",{"id":195,"title":125,"body":196,"description":542,"extension":543,"meta":544,"navigation":545,"path":126,"seo":546,"stem":127,"__hash__":547},"docs\u002F7.administration\u002F4.access.md",{"type":197,"value":198,"toc":537},"minimark",[199,203,208,279,293,296,313,402,422,429,433,440,494,509,515,518,522,533],[200,201,202],"p",{},"API authorization and execution policies serve different purposes. Access assignments grant operations to users or teams; policies govern approval and skipping for prepared work.",[204,205,207],"h2",{"id":206},"assign-the-appropriate-role","Assign the appropriate role",[209,210,211,224],"table",{},[212,213,214],"thead",{},[215,216,217,221],"tr",{},[218,219,220],"th",{},"Role",[218,222,223],{},"Permissions",[225,226,227,239,249,259,269],"tbody",{},[215,228,229,236],{},[230,231,232],"td",{},[233,234,235],"code",{},"admin",[230,237,238],{},"Appliance-wide administration and operations",[215,240,241,246],{},[230,242,243],{},[233,244,245],{},"architect",[230,247,248],{},"Read and deploy within the assigned scope",[215,250,251,256],{},[230,252,253],{},[233,254,255],{},"operator",[230,257,258],{},"Read, deploy, start, approve, and recover within the assigned scope",[215,260,261,266],{},[230,262,263],{},[233,264,265],{},"member",[230,267,268],{},"Read and start Runs within the assigned scope",[215,270,271,276],{},[230,272,273],{},[233,274,275],{},"auditor",[230,277,278],{},"Read retained evidence within the assigned scope",[200,280,281,282,284,285,288,289,292],{},"Use named Environments to scope non-admin assignments. ",[233,283,235],{}," requires ",[233,286,287],{},"environment: '*'",". The API also accepts ",[233,290,291],{},"'*'"," for broad non-admin assignments; use a specific Environment when granting scoped access.",[200,294,295],{},"Create a user interactively, then apply a team and assignment:",[297,298,304],"pre",{"className":299,"code":300,"filename":301,"language":302,"meta":303,"style":303},"language-sh shiki shiki-themes pyplines-light pyplines-light pyplines-dark","pyplines user create alice\n","Terminal","sh","",[233,305,306],{"__ignoreMap":303},[307,308,311],"span",{"class":309,"line":310},"line",1,[307,312,300],{},[314,315,316,356],"code-group",{},[297,317,322],{"className":318,"code":319,"filename":320,"language":321,"meta":303,"style":303},"language-yaml shiki shiki-themes pyplines-light pyplines-light pyplines-dark","name: operations\nmembers:\n  - alice\n","team.yaml","yaml",[233,323,324,338,347],{"__ignoreMap":303},[307,325,326,330,334],{"class":309,"line":310},[307,327,329],{"class":328},"smnRP","name",[307,331,333],{"class":332},"sgMYo",":",[307,335,337],{"class":336},"sfDcV"," operations\n",[307,339,341,344],{"class":309,"line":340},2,[307,342,343],{"class":328},"members",[307,345,346],{"class":332},":\n",[307,348,350,353],{"class":309,"line":349},3,[307,351,352],{"class":332},"  -",[307,354,355],{"class":336}," alice\n",[297,357,360],{"className":318,"code":358,"filename":359,"language":321,"meta":303,"style":303},"name: development-operators\nsubject: team:operations\nrole: operator\nenvironment: development\n","access.yaml",[233,361,362,371,381,391],{"__ignoreMap":303},[307,363,364,366,368],{"class":309,"line":310},[307,365,329],{"class":328},[307,367,333],{"class":332},[307,369,370],{"class":336}," development-operators\n",[307,372,373,376,378],{"class":309,"line":340},[307,374,375],{"class":328},"subject",[307,377,333],{"class":332},[307,379,380],{"class":336}," team:operations\n",[307,382,383,386,388],{"class":309,"line":349},[307,384,385],{"class":328},"role",[307,387,333],{"class":332},[307,389,390],{"class":336}," operator\n",[307,392,394,397,399],{"class":309,"line":393},4,[307,395,396],{"class":328},"environment",[307,398,333],{"class":332},[307,400,401],{"class":336}," development\n",[297,403,405],{"className":299,"code":404,"filename":301,"language":302,"meta":303,"style":303},"pyplines team apply .\u002Fteam.yaml\npyplines access apply .\u002Faccess.yaml\npyplines access list\n",[233,406,407,412,417],{"__ignoreMap":303},[307,408,409],{"class":309,"line":310},[307,410,411],{},"pyplines team apply .\u002Fteam.yaml\n",[307,413,414],{"class":309,"line":340},[307,415,416],{},"pyplines access apply .\u002Faccess.yaml\n",[307,418,419],{"class":309,"line":349},[307,420,421],{},"pyplines access list\n",[200,423,424,425,428],{},"For a direct user assignment, set ",[233,426,427],{},"subject: alice",". Applying a team replaces its membership list; include everyone who should remain in it.",[204,430,432],{"id":431},"require-approvals","Require approvals",[200,434,435,436,439],{},"This example requires one eligible approval for each prepared step in ",[233,437,438],{},"development"," and prevents self-approval by the Run's initiator:",[297,441,444],{"className":318,"code":442,"filename":443,"language":321,"meta":303,"style":303},"name: development-approval\nenvironment: development\napprovals: 1\nallow_self: false\nallow_skip: false\n","policy.yaml",[233,445,446,455,463,474,484],{"__ignoreMap":303},[307,447,448,450,452],{"class":309,"line":310},[307,449,329],{"class":328},[307,451,333],{"class":332},[307,453,454],{"class":336}," development-approval\n",[307,456,457,459,461],{"class":309,"line":340},[307,458,396],{"class":328},[307,460,333],{"class":332},[307,462,401],{"class":336},[307,464,465,468,470],{"class":309,"line":349},[307,466,467],{"class":328},"approvals",[307,469,333],{"class":332},[307,471,473],{"class":472},"sFGQw"," 1\n",[307,475,476,479,481],{"class":309,"line":393},[307,477,478],{"class":328},"allow_self",[307,480,333],{"class":332},[307,482,483],{"class":472}," false\n",[307,485,487,490,492],{"class":309,"line":486},5,[307,488,489],{"class":328},"allow_skip",[307,491,333],{"class":332},[307,493,483],{"class":472},[297,495,497],{"className":299,"code":496,"filename":301,"language":302,"meta":303,"style":303},"pyplines policy apply .\u002Fpolicy.yaml\npyplines policy info development-approval\n",[233,498,499,504],{"__ignoreMap":303},[307,500,501],{"class":309,"line":310},[307,502,503],{},"pyplines policy apply .\u002Fpolicy.yaml\n",[307,505,506],{"class":309,"line":340},[307,507,508],{},"pyplines policy info development-approval\n",[200,510,511,512,514],{},"Ensure another eligible Operator or Admin is available to approve. Use ",[233,513,287],{}," for an appliance-wide rule. Matching policies combine the highest approval count and intersect their permissions; an Environment rule cannot weaken the appliance policy.",[200,516,517],{},"There is no mandatory default approval. Configure policies before exposing operational workflows when approval is required. Approval counts range from 0 to 10; the current policy model has no externally loadable policy language or per-step selector.",[204,519,521],{"id":520},"review-changes","Review changes",[200,523,524,525,528,529,532],{},"Policy, context, and secret changes can invalidate preparation and approval evidence. Inspect waiting Runs after changes. See ",[526,527,467],"a",{"href":92}," for operator behavior and ",[526,530,531],{"href":96},"recovery"," for skip and retry semantics.",[534,535,536],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .smnRP, html code.shiki .smnRP{--shiki-light:#243247;--shiki-default:#243247;--shiki-dark:#DCE6F0}html pre.shiki code .sgMYo, html code.shiki .sgMYo{--shiki-light:#54657A;--shiki-default:#54657A;--shiki-dark:#A9B8CA}html pre.shiki code .sfDcV, html code.shiki .sfDcV{--shiki-light:#34694B;--shiki-default:#34694B;--shiki-dark:#9BC9AD}html pre.shiki code .sFGQw, html code.shiki .sFGQw{--shiki-light:#765093;--shiki-default:#765093;--shiki-dark:#CFB1E8}",{"title":303,"searchDepth":340,"depth":340,"links":538},[539,540,541],{"id":206,"depth":340,"text":207},{"id":431,"depth":340,"text":432},{"id":520,"depth":340,"text":521},"Manage accounts, team roles, and execution requirements.","md",{},true,{"title":125,"description":542},"ZRO4WCUGBdYoXnajVUyOsAkgr9X__2_zMz7_UCzVXqA",[549,551],{"title":121,"path":122,"stem":123,"description":550,"children":-1},"Enroll, admit, drain, and inspect Docker execution nodes.",{"title":129,"path":130,"stem":131,"description":552,"children":-1},"Preserve platform state and maintain a supported component combination.",1792213696792]