Supported access commands
| Command | Purpose |
|---|---|
fleet access list TARGET | List direct grants on one project or Repository. |
fleet access grant TARGET (--principal user:EMAIL_OR_HANDLE | --principal-id ID) --permission PERMISSION | Grant one user access at the selected scope. |
fleet access revoke TARGET (--principal user:EMAIL_OR_HANDLE | --principal-id ID) | Revoke one user’s direct grant. |
fleet access explain TARGET --permission PERMISSION | Explain the current user’s effective access. |
Targets and permissions
A one-segment target is a project. A two-segment NAMESPACE/REPOSITORY target is a Repository; the CLI never retries the other scope. For grant, project targets accept read, write, or admin; Repository targets accept read or write.
Authentication and output
fleet defaults to the Registry setting and credential file used by flt's built-in default context; it does not select named flt contexts. Authenticate the shared credential file with flt auth login HOST. When using another context, pass its matching --settings and --credentials paths explicitly. Global fleet options include --registry, --credentials, --settings, --timeout, --json, and --quiet. JSON output uses fleet.control.v1.
Deliberate scope
Team creation, membership, Runtime administration, content transfer, and local policy inference are outside this CLI. The Registry remains authoritative for every access decision.