zonai rules

Inspect compiled access rules for each table.

Inspect access permissions for each table according to the compiled rules worker. Use this to debug authorization failures.

zonai rules <subcommand> [flags]

rules list#

Show allowed/denied operations for all tables:

zonai rules list        # alias: ls
zonai rules list --jwt eyJhbGc...

Output shows each table and whether create, list, view, update, and delete are allowed for the given identity.

Without --jwt, evaluates as an anonymous request (no JWT).

Show the rule result for a specific table and operation:

zonai rules table tasks update
zonai rules table users view --jwt eyJhbGc...

Pass a JWT token string (without the Bearer prefix) to evaluate rules as an authenticated user:

zonai rules list --jwt eyJhbGciOiJIUzI1NiJ9...

Use case: "does this specific user's token have permission to delete from the posts table?"

The rules worker must be compiled. The server does not need to be running — zonai rules spawns the rules worker directly as a subprocess.

Compile workers if needed:

zonai compile