tfctl harness exec

Use tfctl harness exec to run a child command, such as the command to start your coding agent shell, and enable permission to delete platform resources during the session.

Usage

$ tfctl harness exec --allow-delete=RESOURCE_TYPES -- COMMAND [ARGS...]

Description

The tfctl harness exec command runs a child command with a short-lived, session-scoped permission that lets nested tfctl invocations perform non-interactive deletes.

Granting this permission is a deliberate, per-session opt-in by a human. The permission is tied to the lifetime of this process and auto-reverts to the safe default as soon as the child command exits. Deleting resources requires an interactive confirmation.

The permission is a safety rail, not a security boundary. The child command runs as the same OS user, so a true guarantee that an agent cannot delete must come from the API token permissions set by the server.

Arguments

COMMAND: (Required) The command to run, specified after a -- separator
[ARGS...]: (Optional) Arguments to pass to the command

Flags

--allow-delete=TYPES: Specify resource types that nested processes may delete noninteractively. Only resource types that are explicitly named may be deleted noninteractively. Can be repeated or accept a comma-separated list. See supported resource types below.
- Optional.
- Data type: string (repeatable)
- Default value: None

Supported resource types

The --allow-delete flag accepts the following resource types:

Options

All tfctl commands support options that control output formatting and CLI behavior. Refer to Global flags reference for the complete list of available options.

Examples

The following examples demonstrate how to run a child command with session-scoped delete permissions.

Allow an agent to delete workspaces and variables

The following example allows a coding agent to delete workspaces and variables for one session.

$ tfctl harness exec --allow-delete=workspaces,vars -- opencode

Allow deletes for several resource types with repeated flags

The following example allows deleting multiple resource types using repeated flags.

$ tfctl harness exec --allow-delete=workspaces --allow-delete=vars --allow-delete=run-tasks -- bob