stado credentials grant

Invocation

stado credentials grant <COMMAND>

Consumer grant operations on a host vault

This command has no command-specific inputs or options.

This command group selects one of the subcommands listed below; use its exact child invocation to perform an operation.

Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.

add — Add to a consumer's grant the read of one field of the item that plays a role: by the role (`read:role:<role>#<field>`, what `credentials get --role --route` asks for) and by the item playing it now. --token-file is the consumer's bearer file on the host
consolidate — Merge retired consumer capabilities into Stado's existing bearer
rebind — Bind the stado grant back to the bearer file the fleet holds, when that file no longer opens it: same capabilities, audience and expiry
revoke — Revoke a retired consumer whose every capability the stado grant already holds, leaving one identity on the host's vault. Refused for `stado` and for a consumer holding anything the stado grant lacks
show — Report one consumer's recorded grant
renew — Renew this host's own workload-agent grant until revoked, the way the agent's tick does when the vault still records an end for it: at the authoritative vault, with the capabilities the grant already carries. The consumer is the one the workload agent's configuration names