Explains an AshGrant access decision from the command line.

Uses AshGrant.Introspect.explain_by_identifier/1 under the hood, so the resource's permission resolver must implement the optional load_actor/1 callback. If it doesn't, you'll see actor_loader_not_implemented.

Usage

mix ash_grant.explain --actor USER_ID --resource RESOURCE_KEY --action ACTION [options]

Options

• --actor - Required. Actor identifier (passed to load_actor/1).
• --resource - Required. Resource key (matches resource_name).
• --action - Required. Action name (atom).
• --format - text (default) or json.
• --context - Optional JSON object forwarded to the resolver.

Examples

# Human-readable
mix ash_grant.explain --actor user_123 --resource post --action read

# Machine-readable for CI/LLM pipelines
mix ash_grant.explain --actor user_123 --resource post --action read --format json

# With context
mix ash_grant.explain --actor user_123 --resource post --action read \
  --context '{"reference_date":"2024-01-01"}'

Exit codes

• 0 - Explanation produced (regardless of allow/deny).
• 1 - Lookup failure (unknown resource, actor not found, missing loader).
• 2 - Usage error (missing required option, invalid value).