runbooks / command
Generate roles from a document
Reads any document about who may do what (text, CSV, spreadsheet, JSON, PDF) and proposes the roles, contexts and permissions it describes, merged into roles.json
❯ /runbooks:roles:generate <file...> | <text> [--model <model>]❯ $runbooks:runbooks-roles-generate <file...> | <text> [--model <model>]When executing as a child, you cannot ask the user. When the main session executes this file inline, it asks the user directly and handles calls through the dispatcher. Where this file says to ask (AskUserQuestion, "ask the user", a diff approval), stop with status: question as agents.md says. Where it says to say something and stop, put the message in summary: and report status: done. Commit nothing: the main session commits after it prints your summary.
Edits <paths.runbooks>/roles.json and marks affected runbooks with review. The proposal merges into the registry: it adds roles, contexts, cases, project actions and keys, and replaces the own entry of each key it gives. A role, context or key it leaves out stays as it is. It removes a key only when the source says to. Read first: ${RUNBOOKS_PLUGIN_ROOT}/skills/runbooks/references/config.md, "Roles", and ${RUNBOOKS_PLUGIN_ROOT}/skills/runbooks/references/format.md, "Review".
Parameters
Needs role tracking on. It writes a proposal, shows the roles, contexts and keys it would add or change, and writes roles.json only after you approve. It adds and replaces entries and never deletes a role, a context or a case. Keys it deduced instead of reading from the source get guess.
| Parameter | What it does |
|---|---|
<file...> |
One or more files, relative to the project root: text, Markdown, CSV, a spreadsheet (.xlsx, .xls, .ods), JSON, YAML, PDF, Word or an image of a table. |
<text> |
The rules typed as the argument, such as managers approve invoices, editors only create them. |
--model <m> |
Run this invocation on one model: inline (in the main session), haiku, sonnet, opus or fable. Any value but inline runs the command in a sub-agent on that model. Without it, the command takes its row of the models table in the config: by default roles:generate runs on sonnet. On Codex, the values are inline, inherit (a sub-agent on the session's model) or a model ID the session supports, and the table is codex.models, where every row that is not inline defaults to inherit. See models. |
/runbooks:roles:generate docs/access-matrix.xlsx # a spreadsheet
/runbooks:roles:generate specs/permissions.pdf specs/roles.md # several files
/runbooks:roles:generate support agents see every ticket but only close their own # typed rules
/runbooks:roles:generate docs/access-matrix.xlsx --model opus # on opus, this time only