People and access

vaigil auth grant sam@example.com analyst
vaigil auth grant lee@example.com engineer --for 30d
vaigil auth deny sam@example.com responder --on /security/vulns
vaigil auth explain sam@example.com respond
vaigil auth list

explain walks every binding and says which one decided, and why the others did not. See Roles for what each role may do.

Provisioning with SCIM#

vaigil scim token
vaigil scim map security-analysts analyst
vaigil scim status

The identity provider adds, changes and removes people; a group is mapped to a role or a job.

Tokens#

vaigil token issue ci --principal ci-bot
vaigil token list
vaigil token revoke ID
vaigil token stale

A token is shown once and stored only as a hash. An administrator's token takes a second administrator.