Governance & Access

Access, members, invitations, and data-access authorization (DAC) commands

This page is for checking and adjusting "who can access what" from the CLI. Per-app access is handled by access (your own grants and inviting others), tenant membership by members · invitations, and data access control (DAC) by authz (subjects, presets, access policies, grants). Most write commands are hidden as admin surfaces; this page covers the read and self-service surface regular members use. The full picture of member and role operations is covered in the member management guide.

`axhub access`

Manage app access: grant, revoke, list, and invite collaborators.

This command parses its own subcommands — check details with axhub access <subcommand> --help.

Subcommand	What it does
`access grant`	Grant app access (self-only — use `invite` for others)
`access check`	Check whether access is allowed
`access revoke`	Revoke your own access (removing others uses `uninvite`)
`access invite`	Invite a user to the app
`access uninvite`	Remove an invitation/access

The access-request (access requests) flow has been retired. The server APIs behind it were removed, so these commands no longer work. Use access grant for yourself (public / internet apps) and access invite for others.

`axhub members`

Inspect your tenant membership.

`axhub members me`

Show your own membership in the active tenant.

Flag	Type	Description	Default
`--tenant`	string	Tenant slug or ID used to scope the command.	—

Management commands — member listing, role changes, deactivation — are hidden as admin surfaces. Member hard deletion exists as an API separate from deactivation (DELETE /tenants/{tid}/members/{mid}, spec 173) — the last admin cannot be deleted (409), and a deleted person who rejoins comes back as a new member.

`axhub invitations`

Inspect your tenant invitations.

`axhub invitations accept`

Accept one of your invitations (dry-run by default; use --execute).

Flag	Type	Description	Default
`<id>`	string (positional)	Resource identifier.	—
`--dry-run`	boolean	Preview the operation without applying state changes.	`true`
`--execute`	boolean	Apply the state-changing operation instead of previewing it.	—
`--yes` `-y`	boolean	Assume yes for non-destructive confirmation prompts.	—

`axhub authz`

Data-access authorization: subjects, presets, access policies, and grants (DAC spec 013).

`axhub authz grants`

Manage data-access grants. A grant has four axes — subject × connector × preset, plus a scope (scope_resource_paths) that narrows the target tables and resources (spec 172).

A grant with a scope set has free-form SQL (gateway query) rejected — 403 scope_requires_target, and out-of-scope access fails with 403 scope_out_of_range. See the gateway page for the detailed rules.

`axhub authz grants mine`

List the caller's own active grants.

Flag	Type	Description	Default
`--tenant`	string	Tenant slug or ID used to scope the command.	—

`axhub authz policies`

Inspect connector access policies (row filters, column allow/deny/mask). A policy can be scoped by connector (connector_id) and resource path (resource_path, schema/table), and applies to gateway calls once bound to a grant. Create/update/delete are hidden as admin surfaces.

`axhub authz policies list`

List the tenant's access policies.

Flag	Type	Description	Default
`--tenant`	string	Tenant id/slug/name override. Defaults to the active tenant membership	—

`axhub authz policies show`

Show one access policy's details.

Flag	Type	Description	Default
`<policy_id>`	string (positional)	—	—
`--tenant`	string	Tenant slug or ID used to scope the command.	—

`axhub authz presets`

Manage privilege presets (action templates for grants).

`axhub authz presets list`

List privilege presets in the tenant.

Flag	Type	Description	Default
`--kind`	string	Filter presets by kind	—
`--tenant`	string	Tenant id/slug/name override. Defaults to the active tenant membership	—

`axhub authz presets show`

Show one privilege preset by id.

Flag	Type	Description	Default
`<preset_id>`	string (positional)	—	—
`--tenant`	string	Tenant slug or ID used to scope the command.	—

`axhub authz subjects`

Manage authorization subjects (groups and org units).

`axhub authz subjects list`

List authorization subjects in the tenant.

Flag	Type	Description	Default
`--kind`	string	Filter subjects by kind	—
`--tenant`	string	Tenant id/slug/name override. Defaults to the active tenant membership	—

`axhub authz subjects show`

Show one authorization subject by id.

Flag	Type	Description	Default
`<subject_id>`	string (positional)	—	—
`--tenant`	string	Tenant slug or ID used to scope the command.	—