Wildcard match on actions? Hi team, We make extensive use of actions ending in wildcard (*). I now found out that if an action is offered ending in a column, it doesn't match these. Is this by design or should I use another wildcard for this? example: action in policy:

device_command_show*

offered action:

device_command_show_flash:

NO MATCH offered action:

device_command_show_flash

MATCH

This is by design, the colon is used as a delimiter.

hi Andrew, thanks for your fast reply. Should I understand this as: if a : is found in the action, it is used to cut the action in multiple parts. Each part must match. So if you have a lot of actions, that you'd like to group, it is recommended to use : as a delimiter to create a form of hierarcy? Example: device_commandshow* match device_commandshowrunning match device_commandshowversion device_command:* match device_commandshowrunning match device_command:show

Yep, exactly

Would that allow for a syntax where all the 'child' actions are allowed, no matter how deep they're queried?

Although I'm not sure about your second example; I think

device_command:*

would only match

device_command:show

, not

device_command:show:running

gotcha. So 'unlimited' access MIGHT need:

device_command:*

device_command:*:*

device_command:*:*:*

Yep, indeed