runbooks / command
Manage a role's permissions
Changes what a role may do on each capability/feature key and marks the runbooks the change reaches for review
❯ /runbooks:permissions:manage <name> [--model <model>]❯ $runbooks:runbooks-permissions-manage <name> [--model <model>]Edits <paths.runbooks>/roles.json and marks affected runbooks with review. create runs the same questions for a new role (step 2). Read first: ${RUNBOOKS_PLUGIN_ROOT}/skills/runbooks/references/config.md, "Roles", and ${RUNBOOKS_PLUGIN_ROOT}/skills/runbooks/references/format.md, "Review". Commit policy: ${RUNBOOKS_PLUGIN_ROOT}/skills/runbooks/references/commits.md.
Parameters
Asks which keys change, shows the diff of roles.json, then lists the runbooks of the role and of its heirs that the change reaches and offers to mark them for review. On a key of a context, a role can get different actions in each case. Before 1.8.0 this command was /runbooks:roles:manage-permissions.
| Parameter | What it does |
|---|---|
<name> |
The role whose matrix changes: the actions on each capability/feature key, per case on a key of a context, keys added or removed, and project actions added to actions. anonymous is allowed. |
--model <m> |
Run this invocation on one model: inline (in the main session), haiku, sonnet, opus or fable. Any value but inline runs the command in a sub-agent on that model. Without it, the command takes its row of the models table in the config: by default permissions:manage runs inline. On Codex, the values are inline, inherit (a sub-agent on the session's model) or a model ID the session supports, and the table is codex.models, where every row that is not inline defaults to inherit. See models. |
/runbooks:permissions:manage editor # what editor may do
/runbooks:permissions:manage editor --model sonnet # in a sonnet sub-agent