Access

Roles: owner, maintainer, writer, reader. A role can expire.

Person or machine	Role	Reads overlays	Granted by	Until
Aalice	owner	secrets local-tools board	·	always
Bbob	maintainer	secrets	Aalice	always	Change
Ccarol	reader	payroll board	Aalice	always	Change
executor-eu1	writer	secrets	Aalice	always	Change
Ddan	writer	none	Bbob	1 h 40 min	Revoke

$ access grantlayr access grant dan writer --until 2h

Registry tokens

Tokens let Docker, Helm and Kubernetes pull images. They cannot write.

Token	Scope	Created	Last used	Expires
alice	pull	Oct 2	4 min	Nov 2	Revoke
k8s-prod	pull	Sep 14	1 min	Dec 14	Revoke
bob	pull	Oct 20	yesterday	Nov 20	Revoke

$ access tokenlayr access token k8s-prod --until 90d

$ access tokenlayr access token --revoke bob