@sonisoft/now-sdk-ext-cli 5.0.1 → 5.2.0

package/README.md

@@ -689,7 +689,7 @@ $ npm install -g @sonisoft/now-sdk-ext-cli
 $ nex COMMAND
 running command...
 $ nex (--version)
-@sonisoft/now-sdk-ext-cli/5.0.1 linux-x64 node-v26.5.0
+@sonisoft/now-sdk-ext-cli/5.2.0 linux-x64 node-v26.5.0
 $ nex --help [COMMAND]
 USAGE
   $ nex COMMAND
@@ -697,6 +697,31 @@ USAGE
 ```
 <!-- usagestop -->
 
+
+## Restricting what can be changed
+
+Changes to a ServiceNow instance are **permitted by default**. Two ways to take that
+away, in priority order:
+
+| | | Reachable by an agent? |
+|---|---|---|
+| `NEX_POLICY_DENY=write,execute` (or `all`) | environment | **No** |
+| `--read-only`, `--deny-write`, `--deny-execute` | per invocation | Yes |
+
+Reads are never gated. `nex policy status` prints what is permitted and which layer
+decided — use it first when something is refused, since the fix differs completely
+between an environment variable and a flag.
+
+A malformed value **fails closed**: `NEX_POLICY_DENY=wrtie` denies everything and warns,
+rather than silently denying nothing.
+
+> `NEX_POLICY_DENY` holds only when set somewhere an agent cannot write — a shell
+> profile, a systemd unit, or a container environment. **Not** a committed `.env` or a
+> project-local config file, which anything with file access can edit.
+>
+> This is a guardrail, not a security boundary. Anything holding the credential can
+> reach the instance directly.
+
 # Commands
 <!-- commands -->
 * [`nex aggregate count`](#nex-aggregate-count)
@@ -746,6 +771,7 @@ USAGE
 * [`nex plugins uninstall [PLUGIN]`](#nex-plugins-uninstall-plugin)
 * [`nex plugins unlink [PLUGIN]`](#nex-plugins-unlink-plugin)
 * [`nex plugins update`](#nex-plugins-update)
+* [`nex policy status`](#nex-policy-status)
 * [`nex query`](#nex-query)
 * [`nex query app`](#nex-query-app)
 * [`nex query columns`](#nex-query-columns)
@@ -789,8 +815,8 @@ Count records in a ServiceNow table.
 
 ```
 USAGE
-  $ nex aggregate count -t <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-q
-    <value>]
+  $ nex aggregate count -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -801,8 +827,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Count records in a ServiceNow table.
@@ -828,7 +862,7 @@ EXAMPLES
     $ nex aggregate count --table incident --query "active=true" --json --auth dev
 ```
 
-_See code: [src/commands/aggregate/count.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/aggregate/count.ts)_
+_See code: [src/commands/aggregate/count.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/aggregate/count.ts)_
 
 ## `nex aggregate group`
 
@@ -836,9 +870,9 @@ Run a grouped aggregate query on a ServiceNow table.
 
 ```
 USAGE
-  $ nex aggregate group -t <value> -g <value>... [-j] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [-q <value>] [-c] [--avg <value>...] [--min <value>...] [--max <value>...] [--sum
-    <value>...] [--having <value>] [-d]
+  $ nex aggregate group -t <value> -g <value>... [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>] [-c] [--avg
+    <value>...] [--min <value>...] [--max <value>...] [--sum <value>...] [--having <value>] [-d]
 
 FLAGS
   -a, --auth=<value>         Auth alias to use.
@@ -857,8 +891,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Run a grouped aggregate query on a ServiceNow table.
@@ -888,7 +930,7 @@ EXAMPLES
     $ nex aggregate group --table incident --group-by priority --count --having "count>10" --auth dev
 ```
 
-_See code: [src/commands/aggregate/group.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/aggregate/group.ts)_
+_See code: [src/commands/aggregate/group.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/aggregate/group.ts)_
 
 ## `nex aggregate query`
 
@@ -896,8 +938,9 @@ Run aggregate statistics on a ServiceNow table.
 
 ```
 USAGE
-  $ nex aggregate query -t <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-q
-    <value>] [-c] [--avg <value>...] [--min <value>...] [--max <value>...] [--sum <value>...]
+  $ nex aggregate query -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>] [-c] [--avg <value>...]
+    [--min <value>...] [--max <value>...] [--sum <value>...]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -913,8 +956,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Run aggregate statistics on a ServiceNow table.
@@ -942,7 +993,7 @@ EXAMPLES
     $ nex aggregate query --table incident --sum reassignment_count --json --auth dev
 ```
 
-_See code: [src/commands/aggregate/query.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/aggregate/query.ts)_
+_See code: [src/commands/aggregate/query.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/aggregate/query.ts)_
 
 ## `nex app`
 
@@ -950,8 +1001,8 @@ Manage ServiceNow applications: uninstall applications from your instance.
 
 ```
 USAGE
-  $ nex app [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-u] [-i
-    <value>] [-s <value>]
+  $ nex app [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-u] [-i <value>] [-s <value>]
 
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -962,9 +1013,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Manage ServiceNow applications: uninstall applications from your instance.
@@ -997,7 +1056,7 @@ EXAMPLES
     $ nex app -u -i a1b2c3d4e5f6 -s x_my_custom_app -a dev-instance
 ```
 
-_See code: [src/commands/app/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/app/index.ts)_
+_See code: [src/commands/app/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/app/index.ts)_
 
 ## `nex app install`
 
@@ -1005,8 +1064,8 @@ Install or upgrade multiple ServiceNow applications from a batch definition file
 
 ```
 USAGE
-  $ nex app install [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-b] [-d
-    <value>]
+  $ nex app install [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-b] [-d <value>]
 
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -1016,9 +1075,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Install or upgrade multiple ServiceNow applications from a batch definition file.
@@ -1057,7 +1124,7 @@ EXAMPLES
     $ nex app install -b -d ./apps.json -a dev-instance --log-level debug
 ```
 
-_See code: [src/commands/app/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/app/install.ts)_
+_See code: [src/commands/app/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/app/install.ts)_
 
 ## `nex app repo-install`
 
@@ -1065,8 +1132,9 @@ Install an application from your ServiceNow company repository.
 
 ```
 USAGE
-  $ nex app repo-install -s <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
-    [-w] [--poll-interval <value>] [-t <value>] [-v <value>]
+  $ nex app repo-install -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-w] [--poll-interval <value>] [-t
+    <value>] [-v <value>]
 
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -1079,9 +1147,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Install an application from your ServiceNow company repository.
@@ -1133,7 +1209,7 @@ EXAMPLES
     $ nex app repo-install -s x_my_app -a dev-instance --log-level debug
 ```
 
-_See code: [src/commands/app/repo-install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/app/repo-install.ts)_
+_See code: [src/commands/app/repo-install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/app/repo-install.ts)_
 
 ## `nex app repo-list`
 
@@ -1141,7 +1217,8 @@ List applications available in your ServiceNow company repository.
 
 ```
 USAGE
-  $ nex app repo-list [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-n] [-i]
+  $ nex app repo-list [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-n] [-i]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -1152,8 +1229,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   List applications available in your ServiceNow company repository.
@@ -1199,7 +1284,7 @@ EXAMPLES
     $ nex app repo-list -a dev-instance
 ```
 
-_See code: [src/commands/app/repo-list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/app/repo-list.ts)_
+_See code: [src/commands/app/repo-list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/app/repo-list.ts)_
 
 ## `nex app uninstall`
 
@@ -1207,8 +1292,8 @@ Uninstall a ServiceNow application from your instance.
 
 ```
 USAGE
-  $ nex app uninstall -i <value> -s <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace]
+  $ nex app uninstall -i <value> -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -1218,9 +1303,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Uninstall a ServiceNow application from your instance.
@@ -1253,7 +1346,7 @@ EXAMPLES
     $ nex app uninstall -i a1b2c3d4e5f6 -s x_my_custom_app -a dev-instance
 ```
 
-_See code: [src/commands/app/uninstall.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/app/uninstall.ts)_
+_See code: [src/commands/app/uninstall.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/app/uninstall.ts)_
 
 ## `nex atf`
 
@@ -1261,9 +1354,10 @@ Execute ATF (Automated Test Framework) tests or test suites on a ServiceNow inst
 
 ```
 USAGE
-  $ nex atf [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-t <value> | -s
-    <value> | -n <value>] [-w] [-p <value>] [-b <value>] [--browser-version <value>] [--os-name <value>] [--os-version
-    <value>] [--performance] [--cloud]
+  $ nex atf [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-t <value> | -s <value> | -n <value>] [-w] [-p
+    <value>] [-b <value>] [--browser-version <value>] [--os-name <value>] [--os-version <value>] [--performance]
+    [--cloud]
 
 FLAGS
   -a, --auth=<value>             Auth alias to use.
@@ -1283,8 +1377,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Execute ATF (Automated Test Framework) tests or test suites on a ServiceNow instance.
@@ -1327,7 +1429,7 @@ EXAMPLES
     $ nex atf --suite-id e077e00b83103210621e78c6feaad383 --poll-interval 10000 --auth dev-instance
 ```
 
-_See code: [src/commands/atf/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/atf/index.ts)_
+_See code: [src/commands/atf/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/atf/index.ts)_
 
 ## `nex attachment get`
 
@@ -1335,7 +1437,8 @@ Get metadata for a specific attachment.
 
 ```
 USAGE
-  $ nex attachment get -s <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+  $ nex attachment get -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -1344,9 +1447,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Get metadata for a specific attachment.
@@ -1361,7 +1472,7 @@ EXAMPLES
     $ nex attachment get -s att123 --json --auth dev
 ```
 
-_See code: [src/commands/attachment/get.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/attachment/get.ts)_
+_See code: [src/commands/attachment/get.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/attachment/get.ts)_
 
 ## `nex attachment list`
 
@@ -1369,8 +1480,8 @@ List attachments on a ServiceNow record.
 
 ```
 USAGE
-  $ nex attachment list -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [--limit <value>]
+  $ nex attachment list -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--limit <value>]
 
 FLAGS
   -a, --auth=<value>       Auth alias to use.
@@ -1381,9 +1492,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   List attachments on a ServiceNow record.
@@ -1398,7 +1517,7 @@ EXAMPLES
     $ nex attachment list -t incident -r abc123 --limit 50 --json --auth dev
 ```
 
-_See code: [src/commands/attachment/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/attachment/list.ts)_
+_See code: [src/commands/attachment/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/attachment/list.ts)_
 
 ## `nex attachment upload`
 
@@ -1406,8 +1525,9 @@ Upload a file as an attachment to a ServiceNow record.
 
 ```
 USAGE
-  $ nex attachment upload -f <value> -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [--content-type <value>]
+  $ nex attachment upload -f <value> -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
+    [--content-type <value>]
 
 FLAGS
   -a, --auth=<value>          Auth alias to use.
@@ -1419,9 +1539,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Upload a file as an attachment to a ServiceNow record.
@@ -1436,7 +1564,7 @@ EXAMPLES
     $ nex attachment upload -t incident -r abc123 -f ./data.csv --content-type text/csv --auth dev
 ```
 
-_See code: [src/commands/attachment/upload.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/attachment/upload.ts)_
+_See code: [src/commands/attachment/upload.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/attachment/upload.ts)_
 
 ## `nex auth delete [ALIAS]`
 
@@ -1471,7 +1599,7 @@ EXAMPLES
     $ nex auth delete --all
 ```
 
-_See code: [src/commands/auth/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/auth/delete.ts)_
+_See code: [src/commands/auth/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/auth/delete.ts)_
 
 ## `nex auth doctor`
 
@@ -1499,7 +1627,7 @@ EXAMPLES
     $ nex auth doctor --json
 ```
 
-_See code: [src/commands/auth/doctor.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/auth/doctor.ts)_
+_See code: [src/commands/auth/doctor.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/auth/doctor.ts)_
 
 ## `nex auth list`
 
@@ -1532,7 +1660,7 @@ EXAMPLES
     $ nex auth list --json
 ```
 
-_See code: [src/commands/auth/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/auth/list.ts)_
+_See code: [src/commands/auth/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/auth/list.ts)_
 
 ## `nex auth use ALIAS`
 
@@ -1560,7 +1688,7 @@ EXAMPLES
     $ nex auth use dev206299
 ```
 
-_See code: [src/commands/auth/use.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/auth/use.ts)_
+_See code: [src/commands/auth/use.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/auth/use.ts)_
 
 ## `nex autocomplete [SHELL]`
 
@@ -1591,7 +1719,7 @@ EXAMPLES
   $ nex autocomplete --refresh-cache
 ```
 
-_See code: [@oclif/plugin-autocomplete](https://github.com/oclif/plugin-autocomplete/blob/v3.2.54/src/commands/autocomplete/index.ts)_
+_See code: [@oclif/plugin-autocomplete](https://github.com/oclif/plugin-autocomplete/blob/v3.2.55/src/commands/autocomplete/index.ts)_
 
 ## `nex batch create`
 
@@ -1599,8 +1727,8 @@ Batch create records on a ServiceNow instance from a JSON file.
 
 ```
 USAGE
-  $ nex batch create -f <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
-    [--transaction]
+  $ nex batch create -f <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--transaction]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -1610,9 +1738,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Batch create records on a ServiceNow instance from a JSON file.
@@ -1627,7 +1763,7 @@ EXAMPLES
     $ nex batch create --file ./records.json --no-transaction --auth dev
 ```
 
-_See code: [src/commands/batch/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/batch/create.ts)_
+_See code: [src/commands/batch/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/batch/create.ts)_
 
 ## `nex batch update`
 
@@ -1635,8 +1771,8 @@ Batch update records on a ServiceNow instance from a JSON file.
 
 ```
 USAGE
-  $ nex batch update -f <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
-    [--stop-on-error]
+  $ nex batch update -f <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--stop-on-error]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -1646,9 +1782,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Batch update records on a ServiceNow instance from a JSON file.
@@ -1663,7 +1807,7 @@ EXAMPLES
     $ nex batch update --file ./updates.json --stop-on-error --auth dev
 ```
 
-_See code: [src/commands/batch/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/batch/update.ts)_
+_See code: [src/commands/batch/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/batch/update.ts)_
 
 ## `nex bulk delete`
 
@@ -1671,8 +1815,8 @@ Bulk delete records matching an encoded query.
 
 ```
 USAGE
-  $ nex bulk delete -t <value> -q <value> [-j] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [--confirm] [-l <value>]
+  $ nex bulk delete -t <value> -q <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--confirm] [-l <value>]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -1685,8 +1829,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Bulk delete records matching an encoded query.
@@ -1719,7 +1871,7 @@ EXAMPLES
     $ nex bulk delete --table u_staging --query "processed=true" --confirm --json --auth dev
 ```
 
-_See code: [src/commands/bulk/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/bulk/delete.ts)_
+_See code: [src/commands/bulk/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/bulk/delete.ts)_
 
 ## `nex bulk update`
 
@@ -1727,8 +1879,9 @@ Bulk update records matching an encoded query.
 
 ```
 USAGE
-  $ nex bulk update -t <value> -q <value> -d <value> [-j] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [--confirm] [-l <value>]
+  $ nex bulk update -t <value> -q <value> -d <value> [-j] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--confirm]
+    [-l <value>]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -1742,8 +1895,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Bulk update records matching an encoded query.
@@ -1779,7 +1940,7 @@ EXAMPLES
     $ nex bulk update --table incident --query "active=true" --data '{"state":"6"}' --confirm --json --auth dev
 ```
 
-_See code: [src/commands/bulk/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/bulk/update.ts)_
+_See code: [src/commands/bulk/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/bulk/update.ts)_
 
 ## `nex exec SCOPE [FILE]`
 
@@ -1787,8 +1948,8 @@ Execute JavaScript on a ServiceNow instance remotely using Scripts - Background.
 
 ```
 USAGE
-  $ nex exec SCOPE [FILE] [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
-    [-p <value>]
+  $ nex exec SCOPE [FILE] [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-p <value>]
 
 ARGUMENTS
   SCOPE   Scope to execute script in. Use "global" for global scope.
@@ -1801,9 +1962,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Execute JavaScript on a ServiceNow instance remotely using Scripts - Background.
@@ -1901,7 +2070,7 @@ EXAMPLES
     $ nex exec global ./script.js --auth dev-instance --params '{"token":"abc123","env":"dev"}'
 ```
 
-_See code: [src/commands/exec/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/exec/index.ts)_
+_See code: [src/commands/exec/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/exec/index.ts)_
 
 ## `nex flow action`
 
@@ -1909,8 +2078,9 @@ Execute a Flow Designer action by scoped name.
 
 ```
 USAGE
-  $ nex flow action -n <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-i
-    <value>] [-m foreground|background] [--scope <value>] [--quick]
+  $ nex flow action -n <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-i <value>] [-m
+    foreground|background] [--scope <value>] [--quick]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -1925,8 +2095,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Execute a Flow Designer action by scoped name.
@@ -1946,7 +2124,7 @@ EXAMPLES
       '{"table":"incident","values":{"short_description":"Test"}}' --auth dev
 ```
 
-_See code: [src/commands/flow/action.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/action.ts)_
+_See code: [src/commands/flow/action.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/action.ts)_
 
 ## `nex flow cancel`
 
@@ -1954,8 +2132,8 @@ Cancel a running or paused flow execution.
 
 ```
 USAGE
-  $ nex flow cancel -c <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-r
-    <value>] [--scope <value>]
+  $ nex flow cancel -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-r <value>] [--scope <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -1967,8 +2145,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Cancel a running or paused flow execution.
@@ -1985,7 +2171,7 @@ EXAMPLES
     $ nex flow cancel --context-id abc123def456 --reason "No longer needed" --auth dev
 ```
 
-_See code: [src/commands/flow/cancel.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/cancel.ts)_
+_See code: [src/commands/flow/cancel.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/cancel.ts)_
 
 ## `nex flow copy`
 
@@ -1993,8 +2179,8 @@ Copy an existing flow into a target scoped application.
 
 ```
 USAGE
-  $ nex flow copy -s <value> -n <value> -t <value> [-j] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace]
+  $ nex flow copy -s <value> -n <value> -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -2007,8 +2193,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Copy an existing flow into a target scoped application.
@@ -2042,7 +2236,7 @@ EXAMPLES
       dev
 ```
 
-_See code: [src/commands/flow/copy.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/copy.ts)_
+_See code: [src/commands/flow/copy.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/copy.ts)_
 
 ## `nex flow details`
 
@@ -2050,8 +2244,8 @@ Get rich execution details for a flow context.
 
 ```
 USAGE
-  $ nex flow details -c <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
-    [--scope <value>] [-d]
+  $ nex flow details -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>] [-d]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2063,8 +2257,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Get rich execution details for a flow context.
@@ -2095,7 +2297,7 @@ EXAMPLES
     $ nex flow details -c d4e5f6789012345678abcdef01234567 --json --auth dev
 ```
 
-_See code: [src/commands/flow/details.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/details.ts)_
+_See code: [src/commands/flow/details.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/details.ts)_
 
 ## `nex flow error`
 
@@ -2103,8 +2305,8 @@ Retrieve error details from a failed flow execution.
 
 ```
 USAGE
-  $ nex flow error -c <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
-    [--scope <value>]
+  $ nex flow error -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2115,8 +2317,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Retrieve error details from a failed flow execution.
@@ -2129,7 +2339,7 @@ EXAMPLES
     $ nex flow error --context-id abc123def456 --auth dev
 ```
 
-_See code: [src/commands/flow/error.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/error.ts)_
+_See code: [src/commands/flow/error.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/error.ts)_
 
 ## `nex flow logs`
 
@@ -2137,8 +2347,8 @@ Retrieve flow execution log entries for a given context.
 
 ```
 USAGE
-  $ nex flow logs -c <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-l
-    <value>] [-o asc|desc]
+  $ nex flow logs -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-l <value>] [-o asc|desc]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2151,8 +2361,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Retrieve flow execution log entries for a given context.
@@ -2179,7 +2397,7 @@ EXAMPLES
     $ nex flow logs -c d4e5f6789012345678abcdef01234567 --json --auth dev
 ```
 
-_See code: [src/commands/flow/logs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/logs.ts)_
+_See code: [src/commands/flow/logs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/logs.ts)_
 
 ## `nex flow message`
 
@@ -2187,8 +2405,9 @@ Send a message to a paused flow execution.
 
 ```
 USAGE
-  $ nex flow message -c <value> -m <value> [-j] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [-p <value>] [--scope <value>]
+  $ nex flow message -c <value> -m <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-p <value>] [--scope
+    <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2201,8 +2420,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Send a message to a paused flow execution.
@@ -2220,7 +2447,7 @@ EXAMPLES
     $ nex flow message --context-id abc123def456 --message "data_ready" --payload '{"status":"ok"}' --auth dev
 ```
 
-_See code: [src/commands/flow/message.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/message.ts)_
+_See code: [src/commands/flow/message.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/message.ts)_
 
 ## `nex flow outputs`
 
@@ -2228,8 +2455,8 @@ Retrieve outputs from a completed flow execution.
 
 ```
 USAGE
-  $ nex flow outputs -c <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
-    [--scope <value>]
+  $ nex flow outputs -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2240,8 +2467,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Retrieve outputs from a completed flow execution.
@@ -2258,7 +2493,7 @@ EXAMPLES
     $ nex flow outputs --context-id abc123def456 --json --auth dev
 ```
 
-_See code: [src/commands/flow/outputs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/outputs.ts)_
+_See code: [src/commands/flow/outputs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/outputs.ts)_
 
 ## `nex flow run`
 
@@ -2266,8 +2501,9 @@ Execute a published Flow Designer flow by scoped name.
 
 ```
 USAGE
-  $ nex flow run -n <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-i
-    <value>] [-m foreground|background] [--scope <value>] [--quick]
+  $ nex flow run -n <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-i <value>] [-m
+    foreground|background] [--scope <value>] [--quick]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -2282,8 +2518,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Execute a published Flow Designer flow by scoped name.
@@ -2315,7 +2559,7 @@ EXAMPLES
     $ nex flow run --name global.my_flow --mode background --auth dev
 ```
 
-_See code: [src/commands/flow/run.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/run.ts)_
+_See code: [src/commands/flow/run.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/run.ts)_
 
 ## `nex flow status`
 
@@ -2323,8 +2567,8 @@ Get the status of a flow execution context.
 
 ```
 USAGE
-  $ nex flow status -c <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
-    [--scope <value>]
+  $ nex flow status -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2335,8 +2579,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Get the status of a flow execution context.
@@ -2351,7 +2603,7 @@ EXAMPLES
     $ nex flow status --context-id abc123def456 --auth dev
 ```
 
-_See code: [src/commands/flow/status.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/status.ts)_
+_See code: [src/commands/flow/status.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/status.ts)_
 
 ## `nex flow subflow`
 
@@ -2359,8 +2611,9 @@ Execute a published Flow Designer subflow by scoped name.
 
 ```
 USAGE
-  $ nex flow subflow -n <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-i
-    <value>] [-m foreground|background] [--scope <value>] [--quick]
+  $ nex flow subflow -n <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-i <value>] [-m
+    foreground|background] [--scope <value>] [--quick]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -2375,8 +2628,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Execute a published Flow Designer subflow by scoped name.
@@ -2402,7 +2663,7 @@ EXAMPLES
     $ nex flow subflow --name x_myapp.process_record --inputs '{"table":"incident","sys_id":"abc123"}' --auth dev
 ```
 
-_See code: [src/commands/flow/subflow.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/subflow.ts)_
+_See code: [src/commands/flow/subflow.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/subflow.ts)_
 
 ## `nex flow test`
 
@@ -2410,8 +2671,9 @@ Test a Flow Designer flow without requiring it to be published.
 
 ```
 USAGE
-  $ nex flow test -f <value> -o <value> [-j] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [--scope <value>] [--synchronous]
+  $ nex flow test -f <value> -o <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>]
+    [--synchronous]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2425,8 +2687,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Test a Flow Designer flow without requiring it to be published.
@@ -2456,7 +2726,7 @@ EXAMPLES
     $ nex flow test -f 887dda5583237210fdb8f7b6feaad32c -o '{"current":"abc123"}' --json --auth dev
 ```
 
-_See code: [src/commands/flow/test.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/test.ts)_
+_See code: [src/commands/flow/test.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/test.ts)_
 
 ## `nex health check`
 
@@ -2464,9 +2734,9 @@ Run a consolidated health check on a ServiceNow instance.
 
 ```
 USAGE
-  $ nex health check [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
-    [--include-version] [--include-cluster] [--include-stuck-jobs] [--include-semaphores] [--include-operational-counts]
-    [--stuck-job-threshold <value>]
+  $ nex health check [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--include-version] [--include-cluster]
+    [--include-stuck-jobs] [--include-semaphores] [--include-operational-counts] [--stuck-job-threshold <value>]
 
 FLAGS
   -a, --auth=<value>                     Auth alias to use.
@@ -2481,8 +2751,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Run a consolidated health check on a ServiceNow instance.
@@ -2518,7 +2796,7 @@ EXAMPLES
     $ nex health check --json --auth dev
 ```
 
-_See code: [src/commands/health/check.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/health/check.ts)_
+_See code: [src/commands/health/check.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/health/check.ts)_
 
 ## `nex help [COMMAND]`
 
@@ -2538,7 +2816,7 @@ DESCRIPTION
   Display help for nex.
 ```
 
-_See code: [@oclif/plugin-help](https://github.com/oclif/plugin-help/blob/6.2.55/src/commands/help.ts)_
+_See code: [@oclif/plugin-help](https://github.com/oclif/plugin-help/blob/6.2.56/src/commands/help.ts)_
 
 ## `nex log`
 
@@ -2546,8 +2824,9 @@ Tail and monitor ServiceNow system logs in real-time with beautiful formatting.
 
 ```
 USAGE
-  $ nex log [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-o <value>]
-    [-i <value>] [--no-color] [-f <value>...]
+  $ nex log [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-o <value>] [-i <value>] [--no-color] [-f
+    <value>...]
 
 FLAGS
   -a, --auth=<value>       Auth alias to use.
@@ -2562,9 +2841,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Tail and monitor ServiceNow system logs in real-time with beautiful formatting.
@@ -2645,7 +2932,7 @@ EXAMPLES
     $ nex log --no-color --auth dev-instance
 ```
 
-_See code: [src/commands/log/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/log/index.ts)_
+_See code: [src/commands/log/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/log/index.ts)_
 
 ## `nex plugins`
 
@@ -2937,14 +3224,47 @@ DESCRIPTION
 
 _See code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/5.4.86/src/commands/plugins/update.ts)_
 
+## `nex policy status`
+
+Show what this invocation is permitted to change on the instance, and why.
+
+```
+USAGE
+  $ nex policy status [--json] [--deny-execute] [--deny-write] [--read-only]
+
+FLAGS
+  --deny-execute  Evaluate as if --deny-execute were passed.
+  --deny-write    Evaluate as if --deny-write were passed.
+  --read-only     Evaluate as if --read-only were passed.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Show what this invocation is permitted to change on the instance, and why.
+
+  Changes are permitted by default. NEX_POLICY_DENY, set in the environment, outranks every command-line flag — that is
+  the only layer an agent driving this CLI cannot reach.
+
+EXAMPLES
+  $ nex policy status
+
+  $ nex policy status --read-only
+
+  NEX_POLICY_DENY=all nex policy status
+```
+
+_See code: [src/commands/policy/status.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/policy/status.ts)_
+
 ## `nex query`
 
 Query any ServiceNow table using the Table API.
 
 ```
 USAGE
-  $ nex query -t <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-q
-    <value>] [-f <value>] [-d] [-l <value>]
+  $ nex query -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>] [-f <value>] [-d] [-l
+    <value>]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -2958,8 +3278,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Query any ServiceNow table using the Table API.
@@ -2989,7 +3317,7 @@ EXAMPLES
     $ nex query --table sys_user --query "active=true" --limit 5 --json --auth dev
 ```
 
-_See code: [src/commands/query/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/query/index.ts)_
+_See code: [src/commands/query/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/query/index.ts)_
 
 ## `nex query app`
 
@@ -2997,8 +3325,8 @@ Search for applications by name across scoped apps and plugins.
 
 ```
 USAGE
-  $ nex query app -s <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-a]
-    [-l <value>]
+  $ nex query app -s <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-a] [-l <value>]
 
 FLAGS
   -a, --active          Only show active applications
@@ -3010,8 +3338,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Search for applications by name across scoped apps and plugins.
@@ -3034,7 +3370,7 @@ EXAMPLES
     $ nex query app --search "HR" --active --auth dev
 ```
 
-_See code: [src/commands/query/app.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/query/app.ts)_
+_See code: [src/commands/query/app.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/query/app.ts)_
 
 ## `nex query columns`
 
@@ -3042,8 +3378,8 @@ List and search columns (fields) on a ServiceNow table.
 
 ```
 USAGE
-  $ nex query columns -t <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-s
-    <value>]
+  $ nex query columns -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-s <value>]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3054,8 +3390,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   List and search columns (fields) on a ServiceNow table.
@@ -3081,7 +3425,7 @@ EXAMPLES
     $ nex query columns --table incident --json --auth dev
 ```
 
-_See code: [src/commands/query/columns.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/query/columns.ts)_
+_See code: [src/commands/query/columns.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/query/columns.ts)_
 
 ## `nex query syslog`
 
@@ -3089,8 +3433,8 @@ Query ServiceNow system logs (one-shot, non-tailing).
 
 ```
 USAGE
-  $ nex query syslog [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-q <value>] [-l
-    <value>]
+  $ nex query syslog [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>] [-l <value>]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3101,8 +3445,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Query ServiceNow system logs (one-shot, non-tailing).
@@ -3130,7 +3482,7 @@ EXAMPLES
     $ nex query syslog --query "sourceLIKEincident" --json --auth dev
 ```
 
-_See code: [src/commands/query/syslog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/query/syslog.ts)_
+_See code: [src/commands/query/syslog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/query/syslog.ts)_
 
 ## `nex schema`
 
@@ -3138,8 +3490,9 @@ Discover and inspect a ServiceNow table schema including fields, types, and rela
 
 ```
 USAGE
-  $ nex schema -t <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
-    [--include-choices] [--include-relationships] [--include-ui-policies] [--include-business-rules]
+  $ nex schema -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--include-choices]
+    [--include-relationships] [--include-ui-policies] [--include-business-rules]
 
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -3153,8 +3506,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Discover and inspect a ServiceNow table schema including fields, types, and relationships.
@@ -3180,7 +3541,7 @@ EXAMPLES
     $ nex schema --table incident --include-choices --include-relationships --auth dev
 ```
 
-_See code: [src/commands/schema/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/schema/index.ts)_
+_See code: [src/commands/schema/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/schema/index.ts)_
 
 ## `nex schema field`
 
@@ -3188,8 +3549,8 @@ Get detailed information about a specific field on a ServiceNow table.
 
 ```
 USAGE
-  $ nex schema field -t <value> -f <value> [-j] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace]
+  $ nex schema field -t <value> -f <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3200,8 +3561,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Get detailed information about a specific field on a ServiceNow table.
@@ -3219,7 +3588,7 @@ EXAMPLES
     $ nex schema field --table incident --field priority --json --auth dev
 ```
 
-_See code: [src/commands/schema/field.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/schema/field.ts)_
+_See code: [src/commands/schema/field.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/schema/field.ts)_
 
 ## `nex schema validate-catalog`
 
@@ -3227,7 +3596,8 @@ Validate a ServiceNow catalog item configuration for common issues.
 
 ```
 USAGE
-  $ nex schema validate-catalog -s <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+  $ nex schema validate-catalog -s <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3237,8 +3607,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Validate a ServiceNow catalog item configuration for common issues.
@@ -3256,7 +3634,7 @@ EXAMPLES
     $ nex schema validate-catalog --sys-id a1b2c3d4e5f6 --json --auth dev
 ```
 
-_See code: [src/commands/schema/validate-catalog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/schema/validate-catalog.ts)_
+_See code: [src/commands/schema/validate-catalog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/schema/validate-catalog.ts)_
 
 ## `nex scope`
 
@@ -3264,7 +3642,8 @@ Get the current application scope or list available applications.
 
 ```
 USAGE
-  $ nex scope [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-l]
+  $ nex scope [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-l]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -3273,9 +3652,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Get the current application scope or list available applications.
@@ -3294,7 +3681,7 @@ EXAMPLES
     $ nex scope -l --json --auth dev
 ```
 
-_See code: [src/commands/scope/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/scope/index.ts)_
+_See code: [src/commands/scope/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/scope/index.ts)_
 
 ## `nex scope set`
 
@@ -3302,7 +3689,8 @@ Set the current application scope on a ServiceNow instance.
 
 ```
 USAGE
-  $ nex scope set -a <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+  $ nex scope set -a <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --app-id=<value>  (required) 32-char sys_id of application
@@ -3311,9 +3699,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Set the current application scope on a ServiceNow instance.
@@ -3328,7 +3724,7 @@ EXAMPLES
     $ nex scope set -a abc123def456ghi789jkl012mno345pq --json --auth dev
 ```
 
-_See code: [src/commands/scope/set.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/scope/set.ts)_
+_See code: [src/commands/scope/set.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/scope/set.ts)_
 
 ## `nex script-sync pull`
 
@@ -3337,7 +3733,8 @@ Pull a script from a ServiceNow instance to a local file.
 ```
 USAGE
   $ nex script-sync pull -n <value> -t sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client
-    [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-o <value>]
+    [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>] [--log-file] [--log-level
+    debug|warn|error|info|trace] [--read-only] [-o <value>]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3349,9 +3746,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Pull a script from a ServiceNow instance to a local file.
@@ -3379,7 +3784,7 @@ EXAMPLES
     $ nex script-sync pull -n MyClientScript -t sys_script_client --json --auth dev-instance
 ```
 
-_See code: [src/commands/script-sync/pull.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/script-sync/pull.ts)_
+_See code: [src/commands/script-sync/pull.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/script-sync/pull.ts)_
 
 ## `nex script-sync push`
 
@@ -3388,7 +3793,8 @@ Push a local script file to a ServiceNow instance.
 ```
 USAGE
   $ nex script-sync push -n <value> -t sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client -f
-    <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>] [--log-file]
+    [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3400,9 +3806,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Push a local script file to a ServiceNow instance.
@@ -3431,7 +3845,7 @@ EXAMPLES
     $ nex script-sync push -n MyUIScript -t sys_ui_script -f ./scripts/ui-script.js --json --auth dev-instance
 ```
 
-_See code: [src/commands/script-sync/push.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/script-sync/push.ts)_
+_See code: [src/commands/script-sync/push.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/script-sync/push.ts)_
 
 ## `nex script-sync sync`
 
@@ -3439,7 +3853,8 @@ Synchronize all scripts in a directory with a ServiceNow instance.
 
 ```
 USAGE
-  $ nex script-sync sync -d <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-t
+  $ nex script-sync sync -d <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-t
     sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client...]
 
 FLAGS
@@ -3451,9 +3866,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Synchronize all scripts in a directory with a ServiceNow instance.
@@ -3481,7 +3904,7 @@ EXAMPLES
     $ nex script-sync sync -d ./scripts --json --auth dev-instance
 ```
 
-_See code: [src/commands/script-sync/sync.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/script-sync/sync.ts)_
+_See code: [src/commands/script-sync/sync.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/script-sync/sync.ts)_
 
 ## `nex search`
 
@@ -3489,8 +3912,9 @@ Search platform code across a ServiceNow instance.
 
 ```
 USAGE
-  $ nex search -t <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-l
-    <value>] [-s <value>] [-g <value>] [--table <value>]
+  $ nex search -t <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-l <value>] [-s <value>] [-g <value>]
+    [--table <value>]
 
 FLAGS
   -a, --auth=<value>          Auth alias to use.
@@ -3503,9 +3927,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Search platform code across a ServiceNow instance.
@@ -3539,7 +3971,7 @@ EXAMPLES
     $ nex search --term "GlideRecord" --limit 10 --json --auth dev-instance
 ```
 
-_See code: [src/commands/search/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/search/index.ts)_
+_See code: [src/commands/search/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/search/index.ts)_
 
 ## `nex search add-table`
 
@@ -3547,8 +3979,8 @@ Add a table to a code search group on a ServiceNow instance.
 
 ```
 USAGE
-  $ nex search add-table -f <value> -g <value> -t <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace]
+  $ nex search add-table -f <value> -g <value> -t <value> [--json] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -3559,9 +3991,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Add a table to a code search group on a ServiceNow instance.
@@ -3591,7 +4031,7 @@ EXAMPLES
       dev-instance
 ```
 
-_See code: [src/commands/search/add-table.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/search/add-table.ts)_
+_See code: [src/commands/search/add-table.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/search/add-table.ts)_
 
 ## `nex search groups`
 
@@ -3599,7 +4039,8 @@ List all available code search groups on a ServiceNow instance.
 
 ```
 USAGE
-  $ nex search groups [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+  $ nex search groups [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -3607,9 +4048,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   List all available code search groups on a ServiceNow instance.
@@ -3631,7 +4080,7 @@ EXAMPLES
     $ nex search groups --json --auth dev-instance
 ```
 
-_See code: [src/commands/search/groups.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/search/groups.ts)_
+_See code: [src/commands/search/groups.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/search/groups.ts)_
 
 ## `nex search tables`
 
@@ -3639,7 +4088,8 @@ List tables configured for a specific code search group.
 
 ```
 USAGE
-  $ nex search tables -g <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+  $ nex search tables -g <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>          Auth alias to use.
@@ -3648,9 +4098,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   List tables configured for a specific code search group.
@@ -3673,7 +4131,7 @@ EXAMPLES
     $ nex search tables --search-group "Business Rules" --json --auth dev-instance
 ```
 
-_See code: [src/commands/search/tables.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/search/tables.ts)_
+_See code: [src/commands/search/tables.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/search/tables.ts)_
 
 ## `nex store install`
 
@@ -3681,8 +4139,9 @@ Install an application from the ServiceNow Store.
 
 ```
 USAGE
-  $ nex store install -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [--demo-data] [--no-wait] [--poll-interval <value>] [--timeout <value>]
+  $ nex store install -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--demo-data] [--no-wait]
+    [--poll-interval <value>] [--timeout <value>]
 
 FLAGS
   -a, --app-id=<value>         (required) Store application sys_id
@@ -3696,9 +4155,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Install an application from the ServiceNow Store.
@@ -3717,7 +4184,7 @@ EXAMPLES
     $ nex store install -a abc123 -v 1.0.0 --demo-data --auth dev
 ```
 
-_See code: [src/commands/store/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/store/install.ts)_
+_See code: [src/commands/store/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/store/install.ts)_
 
 ## `nex store search`
 
@@ -3725,8 +4192,9 @@ Search for applications in the ServiceNow Store.
 
 ```
 USAGE
-  $ nex store search [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [--limit
-    <value>] [--tab available_for_you|installed|updates] [-t <value>]
+  $ nex store search [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--limit <value>] [--tab
+    available_for_you|installed|updates] [-t <value>]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3738,9 +4206,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Search for applications in the ServiceNow Store.
@@ -3759,7 +4235,7 @@ EXAMPLES
     $ nex store search --tab updates --limit 10 --auth dev
 ```
 
-_See code: [src/commands/store/search.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/store/search.ts)_
+_See code: [src/commands/store/search.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/store/search.ts)_
 
 ## `nex store update`
 
@@ -3767,8 +4243,9 @@ Update a ServiceNow Store application to a new version.
 
 ```
 USAGE
-  $ nex store update -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [--no-wait] [--poll-interval <value>] [--timeout <value>]
+  $ nex store update -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--no-wait]
+    [--poll-interval <value>] [--timeout <value>]
 
 FLAGS
   -a, --app-id=<value>         (required) Store application sys_id
@@ -3781,9 +4258,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Update a ServiceNow Store application to a new version.
@@ -3802,7 +4287,7 @@ EXAMPLES
     $ nex store update -a abc123 -v 2.0.0 --timeout 3600000 --auth dev
 ```
 
-_See code: [src/commands/store/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/store/update.ts)_
+_See code: [src/commands/store/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/store/update.ts)_
 
 ## `nex store validate`
 
@@ -3810,7 +4295,8 @@ Validate a batch installation definition file.
 
 ```
 USAGE
-  $ nex store validate -f <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+  $ nex store validate -f <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -3819,9 +4305,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Validate a batch installation definition file.
@@ -3832,7 +4326,7 @@ EXAMPLES
     $ nex store validate --file ./batch-definition.json --auth dev
 ```
 
-_See code: [src/commands/store/validate.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/store/validate.ts)_
+_See code: [src/commands/store/validate.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/store/validate.ts)_
 
 ## `nex task approve`
 
@@ -3840,8 +4334,8 @@ Approve a ServiceNow change request.
 
 ```
 USAGE
-  $ nex task approve -n <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-c
-    <value>]
+  $ nex task approve -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-c <value>]
 
 FLAGS
   -a, --auth=<value>      Auth alias to use.
@@ -3851,9 +4345,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Approve a ServiceNow change request.
@@ -3875,7 +4377,7 @@ EXAMPLES
     $ nex task approve -n CHG0010001 -c "Looks good, approved" --auth dev
 ```
 
-_See code: [src/commands/task/approve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/task/approve.ts)_
+_See code: [src/commands/task/approve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/task/approve.ts)_
 
 ## `nex task assign`
 
@@ -3883,8 +4385,9 @@ Assign a ServiceNow task to a user or group.
 
 ```
 USAGE
-  $ nex task assign -n <value> -u <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [-g <value>] [--table <value>]
+  $ nex task assign -n <value> -u <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-g <value>] [--table
+    <value>]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3896,9 +4399,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Assign a ServiceNow task to a user or group.
@@ -3927,7 +4438,7 @@ EXAMPLES
     $ nex task assign --number CHG0010001 --table change_request --user admin --auth dev
 ```
 
-_See code: [src/commands/task/assign.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/task/assign.ts)_
+_See code: [src/commands/task/assign.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/task/assign.ts)_
 
 ## `nex task close`
 
@@ -3935,8 +4446,9 @@ Close a ServiceNow incident.
 
 ```
 USAGE
-  $ nex task close --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [--close-code <value>]
+  $ nex task close --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
+    [--close-code <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -3947,9 +4459,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Close a ServiceNow incident.
@@ -3972,7 +4492,7 @@ EXAMPLES
     $ nex task close -n INC0010001 --notes "Closed" --close-code "Solved (Permanently)" --auth dev
 ```
 
-_See code: [src/commands/task/close.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/task/close.ts)_
+_See code: [src/commands/task/close.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/task/close.ts)_
 
 ## `nex task comment`
 
@@ -3980,8 +4500,9 @@ Add a comment or work note to a ServiceNow task.
 
 ```
 USAGE
-  $ nex task comment -c <value> -n <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [--table <value>] [--work-note]
+  $ nex task comment -c <value> -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--table <value>]
+    [--work-note]
 
 FLAGS
   -a, --auth=<value>     Auth alias to use.
@@ -3993,9 +4514,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Add a comment or work note to a ServiceNow task.
@@ -4023,7 +4552,7 @@ EXAMPLES
     $ nex task comment --number CHG0010001 --table change_request --comment "Approved" --auth dev
 ```
 
-_See code: [src/commands/task/comment.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/task/comment.ts)_
+_See code: [src/commands/task/comment.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/task/comment.ts)_
 
 ## `nex task find`
 
@@ -4031,8 +4560,8 @@ Find a ServiceNow task by its number.
 
 ```
 USAGE
-  $ nex task find -n <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
-    [--table <value>]
+  $ nex task find -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--table <value>]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4042,9 +4571,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Find a ServiceNow task by its number.
@@ -4071,7 +4608,7 @@ EXAMPLES
     $ nex task find -n INC0010001 --json --auth dev
 ```
 
-_See code: [src/commands/task/find.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/task/find.ts)_
+_See code: [src/commands/task/find.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/task/find.ts)_
 
 ## `nex task resolve`
 
@@ -4079,8 +4616,9 @@ Resolve a ServiceNow incident with resolution notes.
 
 ```
 USAGE
-  $ nex task resolve --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [--close-code <value>]
+  $ nex task resolve --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
+    [--close-code <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -4091,9 +4629,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Resolve a ServiceNow incident with resolution notes.
@@ -4116,7 +4662,7 @@ EXAMPLES
     $ nex task resolve -n INC0010001 --notes "Fixed" --close-code "Solved (Permanently)" --auth dev
 ```
 
-_See code: [src/commands/task/resolve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/task/resolve.ts)_
+_See code: [src/commands/task/resolve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/task/resolve.ts)_
 
 ## `nex update-set`
 
@@ -4124,8 +4670,8 @@ List update sets on a ServiceNow instance.
 
 ```
 USAGE
-  $ nex update-set [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [--limit
-    <value>] [-q <value>]
+  $ nex update-set [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--limit <value>] [-q <value>]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -4135,9 +4681,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   List update sets on a ServiceNow instance.
@@ -4156,7 +4710,7 @@ EXAMPLES
     $ nex update-set --json --auth dev-instance
 ```
 
-_See code: [src/commands/update-set/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/update-set/index.ts)_
+_See code: [src/commands/update-set/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/update-set/index.ts)_
 
 ## `nex update-set clone`
 
@@ -4164,8 +4718,8 @@ Clone an update set and its records.
 
 ```
 USAGE
-  $ nex update-set clone -n <value> -s <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace]
+  $ nex update-set clone -n <value> -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4175,9 +4729,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Clone an update set and its records.
@@ -4192,7 +4754,7 @@ EXAMPLES
     $ nex update-set clone --source us-001 --name "Cloned Set" --json --auth dev-instance
 ```
 
-_See code: [src/commands/update-set/clone.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/update-set/clone.ts)_
+_See code: [src/commands/update-set/clone.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/update-set/clone.ts)_
 
 ## `nex update-set create`
 
@@ -4200,8 +4762,8 @@ Create a new update set.
 
 ```
 USAGE
-  $ nex update-set create -n <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
-    [--application <value>] [-d <value>]
+  $ nex update-set create -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--application <value>] [-d <value>]
 
 FLAGS
   -a, --auth=<value>         Auth alias to use.
@@ -4212,9 +4774,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Create a new update set.
@@ -4233,7 +4803,7 @@ EXAMPLES
     $ nex update-set create --name "My Feature Set" --application x_my_app --auth dev-instance
 ```
 
-_See code: [src/commands/update-set/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/update-set/create.ts)_
+_See code: [src/commands/update-set/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/update-set/create.ts)_
 
 ## `nex update-set current`
 
@@ -4241,7 +4811,8 @@ Get or set the current update set.
 
 ```
 USAGE
-  $ nex update-set current [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-s <value>]
+  $ nex update-set current [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-s <value>]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -4250,9 +4821,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Get or set the current update set.
@@ -4271,7 +4850,7 @@ EXAMPLES
     $ nex update-set current --json --auth dev-instance
 ```
 
-_See code: [src/commands/update-set/current.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/update-set/current.ts)_
+_See code: [src/commands/update-set/current.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/update-set/current.ts)_
 
 ## `nex update-set inspect`
 
@@ -4279,7 +4858,8 @@ Inspect the components of an update set.
 
 ```
 USAGE
-  $ nex update-set inspect -s <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+  $ nex update-set inspect -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4288,9 +4868,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Inspect the components of an update set.
@@ -4305,7 +4893,7 @@ EXAMPLES
     $ nex update-set inspect --sys-id us-001 --json --auth dev-instance
 ```
 
-_See code: [src/commands/update-set/inspect.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/update-set/inspect.ts)_
+_See code: [src/commands/update-set/inspect.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/update-set/inspect.ts)_
 
 ## `nex update-set move`
 
@@ -4313,8 +4901,9 @@ Move records between update sets.
 
 ```
 USAGE
-  $ nex update-set move --target <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [--records <value>] [--source <value>]
+  $ nex update-set move --target <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--records <value>]
+    [--source <value>]
 
 FLAGS
   -a, --auth=<value>     Auth alias to use.
@@ -4325,9 +4914,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Move records between update sets.
@@ -4346,7 +4943,7 @@ EXAMPLES
     $ nex update-set move --target us-002 --source us-001 --json --auth dev-instance
 ```
 
-_See code: [src/commands/update-set/move.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/update-set/move.ts)_
+_See code: [src/commands/update-set/move.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/update-set/move.ts)_
 
 ## `nex workflow create`
 
@@ -4354,7 +4951,8 @@ Create a complete workflow from a JSON specification file.
 
 ```
 USAGE
-  $ nex workflow create -s <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+  $ nex workflow create -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -4363,9 +4961,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Create a complete workflow from a JSON specification file.
@@ -4380,7 +4986,7 @@ EXAMPLES
     $ nex workflow create -s ./workflow.json --json --auth dev
 ```
 
-_See code: [src/commands/workflow/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/workflow/create.ts)_
+_See code: [src/commands/workflow/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/workflow/create.ts)_
 
 ## `nex workflow publish`
 
@@ -4388,8 +4994,8 @@ Publish a workflow version.
 
 ```
 USAGE
-  $ nex workflow publish -s <value> -v <value> [--json] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace]
+  $ nex workflow publish -s <value> -v <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -4399,9 +5005,17 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Publish a workflow version.
@@ -4416,7 +5030,7 @@ EXAMPLES
     $ nex workflow publish -v wfv-001 -s act-001 --json --auth dev
 ```
 
-_See code: [src/commands/workflow/publish.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/workflow/publish.ts)_
+_See code: [src/commands/workflow/publish.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/workflow/publish.ts)_
 
 ## `nex xml export`
 
@@ -4424,8 +5038,8 @@ Export a single ServiceNow record as XML.
 
 ```
 USAGE
-  $ nex xml export -t <value> -s <value> [-j] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace] [-o <value>]
+  $ nex xml export -t <value> -s <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-o <value>]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4437,8 +5051,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Export a single ServiceNow record as XML.
@@ -4466,7 +5088,7 @@ EXAMPLES
     $ nex xml export --table sys_script --sys-id abc123 --json --auth dev
 ```
 
-_See code: [src/commands/xml/export.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/xml/export.ts)_
+_See code: [src/commands/xml/export.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/xml/export.ts)_
 
 ## `nex xml import`
 
@@ -4474,8 +5096,8 @@ Import XML records into a ServiceNow instance.
 
 ```
 USAGE
-  $ nex xml import -f <value> -t <value> [-j] [-a <value>] [--cred-store] [--log-level
-    debug|warn|error|info|trace]
+  $ nex xml import -f <value> -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -4486,8 +5108,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Import XML records into a ServiceNow instance.
@@ -4510,7 +5140,7 @@ EXAMPLES
     $ nex xml import --file ./records.xml --table incident --json --auth dev
 ```
 
-_See code: [src/commands/xml/import.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/xml/import.ts)_
+_See code: [src/commands/xml/import.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/xml/import.ts)_
 <!-- commandsstop -->
 
 ---