Command Overview

User, role, and permission commands work at two levels: resource-level permissions with OPA policies, and end users with roles.

Permissions and Policies

Command	Purpose
tcb policy list	Query the policy list
tcb policy get	Get policy content
tcb policy set	Set an OPA Rego policy
tcb permission	Resource permissions under the legacy gateway (retired)

Users and Roles

Command	Purpose
tcb user list	Query the user list
tcb user create	Create a user
tcb user update	Update a user
tcb user delete	Delete a user
tcb role list	Query the role list
tcb role get	Query role details
tcb role create	Create a custom role
tcb role update	Update a role
tcb role delete	Delete a role
System Preset Policies	Preset policies available when creating a role

Notes

• Use tcb policy for OPA policies in new projects; tcb permission only applies to the legacy gateway and is retired
• Users belong to an environment, so commands need -e/--env-id
• Roles apply to end users, policies apply to API access
• Setting a Rego policy invalidates legacy gateway authentication immediately