ironflow role

Manage custom roles for enterprise authorization.

ironflow role <subcommand> [flags]

Custom roles extend the three built-in roles (admin, developer, viewer) with organization-scoped roles that can have policies attached. See Custom Roles & CEL Policies for full details.

ironflow role create

Create a new custom role in an organization.

ironflow role create <name> [flags]

Arguments:

Argument	Required	Description
name	Yes	Role name

Flags:

Flag	Short	Type	Default	Description
--org		string		Organization ID (required)
--server	-s	string		Server URL override

Output:

Created role: billing-team (id: role_a1b2c3d4)

ironflow role list

List all roles, optionally filtered by organization.

ironflow role list [flags]

Flags:

Flag	Short	Type	Default	Description
--org		string		Filter by organization
--json		bool	false	Output as JSON
--server	-s	string		Server URL override

Output:

ID              NAME        ORG_ID       DEFAULT
role_a1b2c3d4   admin       org_default  true
role_e5f6g7h8   developer   org_default  true
role_i9j0k1l2   viewer      org_default  true
role_m3n4o5p6   billing     org_default  false

ironflow role get

Get detailed information about a role.

ironflow role get <id> [flags]

Arguments:

Argument	Required	Description
id	Yes	Role ID

Flags:

Flag	Short	Type	Default	Description
--json		bool	false	Output as JSON
--server	-s	string		Server URL override

Output:

ID:      role_a1b2c3d4
Name:    billing-team
Org ID:  org_default
Default: false

ironflow role delete

Delete a custom role by its ID.

ironflow role delete <id> [flags]

Arguments:

Argument	Required	Description
id	Yes	Role ID

Flags:

Flag	Short	Type	Default	Description
--server	-s	string		Server URL override

Output:

Role deleted

ironflow role assign-policy

Assign a policy to a role.

ironflow role assign-policy <role_id> <policy_id> [flags]

Arguments:

Argument	Required	Description
role_id	Yes	Role ID
policy_id	Yes	Policy ID

Flags:

Flag	Short	Type	Default	Description
--server	-s	string		Server URL override

Output:

Policy assigned to role

ironflow role remove-policy

Remove a policy from a role.

ironflow role remove-policy <role_id> <policy_id> [flags]

Arguments:

Argument	Required	Description
role_id	Yes	Role ID
policy_id	Yes	Policy ID

Flags:

Flag	Short	Type	Default	Description
--server	-s	string		Server URL override

Output:

Policy removed from role

Examples:

# Create a custom role
ironflow role create billing-team --org org_default

# List all roles
ironflow role list
ironflow role list --org org_default --json

# Get role details
ironflow role get role_a1b2c3d4

# Assign a policy to a role
ironflow role assign-policy role_a1b2c3d4 pol_x1y2z3

# Remove a policy from a role
ironflow role remove-policy role_a1b2c3d4 pol_x1y2z3

# Delete a custom role
ironflow role delete role_a1b2c3d4

---