Inspect access permissions for each table according to the compiled rules worker. Use this to debug authorization failures.
zonai rules <subcommand> [flags]
rules list#
Show allowed/denied operations for all tables:
zonai rules list # alias: ls
zonai rules list --jwt eyJhbGc...
Output shows each table and whether create, list, view, update, and
delete are allowed for the given identity.
Without --jwt, evaluates as an anonymous request (no JWT).
rules table#
Show the rule result for a specific table and operation:
zonai rules table tasks update
zonai rules table users view --jwt eyJhbGc...
The --jwt Flag#
Pass a JWT token string (without the Bearer prefix) to evaluate rules as an authenticated user:
zonai rules list --jwt eyJhbGciOiJIUzI1NiJ9...
Use case: "does this specific user's token have permission to delete from the posts table?"
Requirements#
The rules worker must be compiled. The server does not need to be running — zonai rules spawns the rules worker directly as a subprocess.
Compile workers if needed:
zonai compile