fusion-roles-cli
Deploy and manage Fusion Roles V2 configuration using the fusion-roles-cli (froles). USE FOR: deploy role config from a JSON file, create roles/bindings/assignments, export current role state, inspect role assignments. DO NOT USE FOR: database provisioning, application code changes, Azure AD group management outside role bindings, or Roles V1 management.
- Installs
- 406
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/equinor/fusion-skills --skill fusion-roles-cli- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads fusion-roles-cli automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Fusion Roles CLI
When to use
Use when Fusion Roles V2 resources (roles, bindings, assignments, scope types) need to be created or updated from a config file, or when existing role state needs to be inspected or exported.
Typical triggers:
- "Deploy the roles config for my service"
- "Create roles from this JSON file"
- "Export the current role config for fusion-myservice"
- "What does a roles config file look like?"
- "Add a binding for this Entra group"
- "Check what roles are assigned to this account"
- "Dry-run the role deployment"
When not to use
- Database provisioning — use
fusion-infra-cli - Managing Azure AD groups themselves — use the Azure portal or Graph API
- Roles V1 (legacy system) — this tool targets Roles V2 only
- Application code changes
Prerequisites
Install froles as a .NET global tool:
dotnet tool install --global \
--add-source "https://statoil-proview.pkgs.visualstudio.com/Fusion%20-%20Packages/_packaging/Fusion-Public/nuget/v3/index.json" \
Fusion.Roles.Cli
Update to latest:
froles --update
Auth uses DefaultAzureCredential automatically (picks up az login session). Pass -t <token> to override.
Core workflow — deploy a role config
1. Create the config file
The config file is a JSON file declaring all role resources for your system. Always include the $schema reference — it enables editor validation and autocompletion.
Minimal example (roles-config.json):
{
"$schema": "https://rolesv2.api.fusion.equinor.com/public/schemas/role-config.schema.json",
"accessRoles": [
{
"systemIdentifier": "my-service",
"name": "MyService.Project.Read",
"description": "Read access to project resources"
}
],
"roles": [
{
"name": "project-viewer",
"displayName": "Project Viewer",
"accessRoleMappings": [
{ "accessRoleIdentifier": "MyService.Project.Read" }
]
}
]
}
See references/role-config-schema.md for the full schema with all resource types and field definitions.
2. Dry-run to verify changes
Always dry-run before deploying to catch unexpected changes:
froles create -e ci --file roles-config.json --dry-run
The dry-run shows exactly what will be created, patched, or left unchanged — including binding diffs showing added/removed roles.
3. Deploy
# CI
froles create -e ci --file roles-config.json
# QA
froles create -e fqa --file roles-config.json
# Production
froles create -e fprd --file roles-config.json
create is idempotent — safe to run repeatedly. Resources are matched on natural keys; only changed fields are patched.
4. Export current state (optional)
To export the current configuration for a system (useful for initial onboarding or auditing):
froles export my-service -e ci -o current-state.json
The export file can be modified and fed back into create.
Reconciliation behaviour
The create command reconciles each resource type against its natural key:
| Resource | Natural key | Behaviour |
|---|---|---|
| Scope types | name | Create if missing; patch description if changed |
| Access roles | systemIdentifier + name | Create if missing; patch if changed |
| Roles / claimable roles | name | Create if missing; patch if changed; access role mappings fully reconciled |
| Bindings | identifier | Patch all fields; diff shows role/group additions and removals |
| Role assignments | roleIdentifier + source + externalIdentifier | Create if missing; skip if exists |
Important: Access role mappings on roles/claimable roles are fully reconciled — mappings absent from the config are removed. Only access roles belonging to systems declared in the config file are managed.
Environments
| Key | Purpose |
|---|---|
ci | Continuous integration |
fqa | QA / pre-production |
fprd | Production |
tr | Training environment |
Full reference
For complete command and flag reference, run:
froles --help
froles create --help
Or see the source documentation:
Safety
- Always dry-run before deploying to production
- Access role mapping reconciliation removes unmapped roles — review the dry-run output carefully
- Never store tokens in config files; always use
-t <token>from a secret variable in pipelines delete role-assignmentsis destructive — confirm with user and dry-run first
FAQ
What does the fusion-roles-cli skill do?
Deploy and manage Fusion Roles V2 configuration using the fusion-roles-cli (froles). USE FOR: deploy role config from a JSON file, create roles/bindings/assignments, export current role state, inspect role assignments. DO NOT USE FOR: database provisioning, application code changes, Azure AD group management outside role bindings, or Roles V1 management.
How do I install fusion-roles-cli?
Run npx skills add https://github.com/equinor/fusion-skills --skill fusion-roles-cli in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/fusion-roles-cli/ (personal) or .claude/skills/fusion-roles-cli/ (project).
Which AI agents can use fusion-roles-cli?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is fusion-roles-cli safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains fusion-roles-cli?
It is published by equinor in equinor/fusion-skills. It has 406 recorded installs.
More from equinor/fusion-skills
fusion-issue-authoring
equinor/fusion-skills
Classify issue type, activate the matching agent mode for type-specific drafting, and enforce shared safety gates before GitHub mutation.
fusion-github-review-resolution
equinor/fusion-skills
Resolves unresolved GitHub PR review threads end-to-end: evaluates whether each review comment is correct, applies a targeted fix when valid, replies with rationale when not, commits, and resolves the thread. USE FOR: unresolved review threads, PR review feedback, changes requested PRs, PR review URLs (pullrequestreview-...), fix the review comments, close the open threads, address PR feedback. DO NOT USE FOR: summarizing feedback without code changes, creating new PRs, or read-only branches.
fusion-issue-solving
equinor/fusion-skills
Handles GitHub issue resolution end-to-end for prompts like "solve 123", "lets solve 123", "work on 123", "work on https://github.com/owner/repo/issues/123", or by pasting a direct GitHub issue URL as the request. USE FOR: solve 123, continue work on issue 123, work on https://github.com/owner/repo/issues/123, paste a GitHub issue URL for implementation work. DO NOT USE FOR: issue drafting only, PR review only, or non-implementation research.
fusion-code-conventions
equinor/fusion-skills
Applies and explains code conventions across TypeScript, React, C, and Markdown. Enforces naming rules, file naming patterns, TSDoc and XML doc standards, inline comment intent (the why, not the what), code structure, error handling, async patterns, and dead code policy. Also enforces ADR and contributor doc decisions, and flags decisions that appear stale or misaligned with current tooling. USE FOR: convention questions, code review against project standards, applying naming rules, auditing intent comments, checking TSDoc completeness, enforcing recorded ADR decisions, and flagging stale architectural decisions. DO NOT USE FOR: security vulnerability scanning, performance profiling, runtime debugging, or generating net-new code without a review target.
fusion-dependency-review
equinor/fusion-skills
Review dependency PRs with structured research, existing-PR-discussion capture, multi-lens analysis (security, code quality, impact), and a repeatable verdict template. USE FOR: dependency update PRs, Renovate/Dependabot PRs, library upgrade reviews, "review this dependency PR", "should we merge this update". DO NOT USE FOR: feature PRs, application code reviews, dependency automation/bot configuration, or unattended merge without confirmation.
fusion-mcp
equinor/fusion-skills
Explain what Fusion MCP is and guide users through setting it up when they need Fusion-aware MCP capabilities in Copilot workflows.
Popular devops & cloud skills
microsoft-foundry
microsoft/azure-skills
Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent create, managed harness agent create, GitHub Copilot harness agent, create agent, update agent, add tool to agent, invoke agent, agent insights, evaluate agent, batch eval, continuous eval, continuous monitoring, agent CI/CD, optimize prompt, improve prompt, optimize agent instructions, Agent Optimizer scaffold, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure
azure-diagnostics
microsoft/azure-skills
Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.
azure-prepare
microsoft/azure-skills
Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.
azure-ai
microsoft/azure-skills
Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.
azure-deploy
microsoft/azure-skills
Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.
azure-validate
microsoft/azure-skills
Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment.