ak skills grants
ak skills grants revoke
Remove one exec grant by id, or all grants, so the entrypoints can no longer run until granted again.
Use ak skills grants revoke to withdraw permission from
ak skills exec. A revoked entrypoint fails with exec.not_granted
until it is granted again.
Usage
ak skills grants revoke <grant-id>
ak skills grants revoke --allGive exactly one of a grant id or --all; otherwise the command exits 2.
Options
| Flag | Default | Description |
|---|---|---|
--all | false | Revoke every recorded grant. |
Find ids with ak skills grants list. Ids look like eg-<16 hex>.
AGENTKIT_SKILL_EXEC_BROKER=1 is required. Shared flags are described in
CLI conventions.
Output
JSON uses kind=skills.grants.revoke with these fields under data:
revoked[]revoked[] holds the ids that were removed.
Effects and exits
The command rewrites AGENTKIT_HOME/state/exec/grants.json atomically.
| Exit | Meaning |
|---|---|
0 | The grants were revoked. |
1 | Command failure, such as a busy grants store. |
2 | The broker is disabled, or neither or both of an id and --all were given. |
5 | The grant id is unknown (exec.grant_not_found). |
7 | The grants file is invalid. |