pve_acl_prune
Remove or narrow over-broad ACL grants on Proxmox resources. Dry-run shows plan, then confirm to execute safely without widening access.
Instructions
MUTATION: prune (remove/narrow) an over-broad ACL grant flagged by pve_overbroad_grants.
Dry-run by default (returns a PLAN naming every principal losing/gaining what, and flagging shadow/widen gotchas); confirm=True executes and returns a dict. Non-atomic — a revoke PUT then an optional narrower re-grant PUT — but safe-direction: a partial failure only narrows access, never widens it. Synchronous. roleid = the over-broad role to remove (from detection).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | Principal type of target: 'user', 'group', or 'token'. | user |
| path | Yes | Resource path of the over-broad ACL entry to prune, e.g. '/'. | |
| roleid | No | The over-broad role id to remove, as identified by pve_overbroad_grants. | |
| target | Yes | Principal the over-broad grant belongs to: userid, groupid, or tokenid depending on kind. | |
| confirm | No | False (default) returns a dry-run PLAN preview; True executes the mutation. | |
| narrow_path | No | Optional narrower path to scope the re-grant to, instead of the original path. | |
| narrow_role | No | Optional narrower role id to re-grant in place of the removed one. | |
| proximo_target | No | Which configured Proxmox target to run this call against — a target name from your multi-target config (a specific PVE/PBS/PMG/PDM box). Omit to use the single/default target from the environment; the selection applies only to this call. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |