npm - @sonisoft/now-sdk-ext-cli - Versions diffs - 5.1.0 → 5.2.0 - Mend

@sonisoft/now-sdk-ext-cli 5.1.0 → 5.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/README.md +560 -213
package/dist/commands/policy/status.d.ts +27 -0
package/dist/commands/policy/status.d.ts.map +1 -0
package/dist/commands/policy/status.js +67 -0
package/dist/commands/policy/status.js.map +1 -0
package/dist/common/authenticated-command.d.ts +3 -0
package/dist/common/authenticated-command.d.ts.map +1 -1
package/dist/common/authenticated-command.js +49 -1
package/dist/common/authenticated-command.js.map +1 -1
package/dist/common/policy.d.ts +32 -0
package/dist/common/policy.d.ts.map +1 -0
package/dist/common/policy.js +68 -0
package/dist/common/policy.js.map +1 -0
package/oclif.manifest.json +1873 -213
package/package.json +46 -43

package/README.md CHANGED Viewed

@@ -689,7 +689,7 @@ $ npm install -g @sonisoft/now-sdk-ext-cli
 $ nex COMMAND
 running command...
 $ nex (--version)
-@sonisoft/now-sdk-ext-cli/5.1.0 linux-x64 node-v26.5.0
+@sonisoft/now-sdk-ext-cli/5.2.0 linux-x64 node-v26.5.0
 $ nex --help [COMMAND]
 USAGE
   $ nex COMMAND
@@ -697,6 +697,31 @@ USAGE
 ```
 <!-- usagestop -->
+## Restricting what can be changed
+Changes to a ServiceNow instance are **permitted by default**. Two ways to take that
+away, in priority order:
+| | | Reachable by an agent? |
+|---|---|---|
+| `NEX_POLICY_DENY=write,execute` (or `all`) | environment | **No** |
+| `--read-only`, `--deny-write`, `--deny-execute` | per invocation | Yes |
+Reads are never gated. `nex policy status` prints what is permitted and which layer
+decided — use it first when something is refused, since the fix differs completely
+between an environment variable and a flag.
+A malformed value **fails closed**: `NEX_POLICY_DENY=wrtie` denies everything and warns,
+rather than silently denying nothing.
+> `NEX_POLICY_DENY` holds only when set somewhere an agent cannot write — a shell
+> profile, a systemd unit, or a container environment. **Not** a committed `.env` or a
+> project-local config file, which anything with file access can edit.
+>
+> This is a guardrail, not a security boundary. Anything holding the credential can
+> reach the instance directly.
 # Commands
 <!-- commands -->
 * [`nex aggregate count`](#nex-aggregate-count)
@@ -746,6 +771,7 @@ USAGE
 * [`nex plugins uninstall [PLUGIN]`](#nex-plugins-uninstall-plugin)
 * [`nex plugins unlink [PLUGIN]`](#nex-plugins-unlink-plugin)
 * [`nex plugins update`](#nex-plugins-update)
+* [`nex policy status`](#nex-policy-status)
 * [`nex query`](#nex-query)
 * [`nex query app`](#nex-query-app)
 * [`nex query columns`](#nex-query-columns)
@@ -789,8 +815,8 @@ Count records in a ServiceNow table.
 ```
 USAGE
-  $ nex aggregate count -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-q <value>]
+  $ nex aggregate count -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -801,12 +827,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Count records in a ServiceNow table.
@@ -832,7 +862,7 @@ EXAMPLES
     $ nex aggregate count --table incident --query "active=true" --json --auth dev
 ```
-_See code: [src/commands/aggregate/count.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/aggregate/count.ts)_
+_See code: [src/commands/aggregate/count.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/aggregate/count.ts)_
 ## `nex aggregate group`
@@ -840,9 +870,9 @@ Run a grouped aggregate query on a ServiceNow table.
 ```
 USAGE
-  $ nex aggregate group -t <value> -g <value>... [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [-q <value>] [-c] [--avg <value>...] [--min <value>...] [--max <value>...]
-    [--sum <value>...] [--having <value>] [-d]
+  $ nex aggregate group -t <value> -g <value>... [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>] [-c] [--avg
+    <value>...] [--min <value>...] [--max <value>...] [--sum <value>...] [--having <value>] [-d]
 FLAGS
   -a, --auth=<value>         Auth alias to use.
@@ -861,12 +891,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Run a grouped aggregate query on a ServiceNow table.
@@ -896,7 +930,7 @@ EXAMPLES
     $ nex aggregate group --table incident --group-by priority --count --having "count>10" --auth dev
 ```
-_See code: [src/commands/aggregate/group.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/aggregate/group.ts)_
+_See code: [src/commands/aggregate/group.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/aggregate/group.ts)_
 ## `nex aggregate query`
@@ -904,9 +938,9 @@ Run aggregate statistics on a ServiceNow table.
 ```
 USAGE
-  $ nex aggregate query -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-q <value>] [-c] [--avg <value>...] [--min <value>...] [--max <value>...] [--sum
-    <value>...]
+  $ nex aggregate query -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>] [-c] [--avg <value>...]
+    [--min <value>...] [--max <value>...] [--sum <value>...]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -922,12 +956,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Run aggregate statistics on a ServiceNow table.
@@ -955,7 +993,7 @@ EXAMPLES
     $ nex aggregate query --table incident --sum reassignment_count --json --auth dev
 ```
-_See code: [src/commands/aggregate/query.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/aggregate/query.ts)_
+_See code: [src/commands/aggregate/query.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/aggregate/query.ts)_
 ## `nex app`
@@ -963,8 +1001,8 @@ Manage ServiceNow applications: uninstall applications from your instance.
 ```
 USAGE
-  $ nex app [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-u] [-i <value>] [-s <value>]
+  $ nex app [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-u] [-i <value>] [-s <value>]
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -975,6 +1013,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -982,6 +1022,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Manage ServiceNow applications: uninstall applications from your instance.
@@ -1014,7 +1056,7 @@ EXAMPLES
     $ nex app -u -i a1b2c3d4e5f6 -s x_my_custom_app -a dev-instance
 ```
-_See code: [src/commands/app/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/app/index.ts)_
+_See code: [src/commands/app/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/app/index.ts)_
 ## `nex app install`
@@ -1022,8 +1064,8 @@ Install or upgrade multiple ServiceNow applications from a batch definition file
 ```
 USAGE
-  $ nex app install [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-b] [-d <value>]
+  $ nex app install [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-b] [-d <value>]
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -1033,6 +1075,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1040,6 +1084,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Install or upgrade multiple ServiceNow applications from a batch definition file.
@@ -1078,7 +1124,7 @@ EXAMPLES
     $ nex app install -b -d ./apps.json -a dev-instance --log-level debug
 ```
-_See code: [src/commands/app/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/app/install.ts)_
+_See code: [src/commands/app/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/app/install.ts)_
 ## `nex app repo-install`
@@ -1086,8 +1132,9 @@ Install an application from your ServiceNow company repository.
 ```
 USAGE
-  $ nex app repo-install -s <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-w] [--poll-interval <value>] [-t <value>] [-v <value>]
+  $ nex app repo-install -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-w] [--poll-interval <value>] [-t
+    <value>] [-v <value>]
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -1100,6 +1147,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1107,6 +1156,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Install an application from your ServiceNow company repository.
@@ -1158,7 +1209,7 @@ EXAMPLES
     $ nex app repo-install -s x_my_app -a dev-instance --log-level debug
 ```
-_See code: [src/commands/app/repo-install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/app/repo-install.ts)_
+_See code: [src/commands/app/repo-install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/app/repo-install.ts)_
 ## `nex app repo-list`
@@ -1166,8 +1217,8 @@ List applications available in your ServiceNow company repository.
 ```
 USAGE
-  $ nex app repo-list [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-n] [-i]
+  $ nex app repo-list [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-n] [-i]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -1178,12 +1229,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   List applications available in your ServiceNow company repository.
@@ -1229,7 +1284,7 @@ EXAMPLES
     $ nex app repo-list -a dev-instance
 ```
-_See code: [src/commands/app/repo-list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/app/repo-list.ts)_
+_See code: [src/commands/app/repo-list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/app/repo-list.ts)_
 ## `nex app uninstall`
@@ -1237,8 +1292,8 @@ Uninstall a ServiceNow application from your instance.
 ```
 USAGE
-  $ nex app uninstall -i <value> -s <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace]
+  $ nex app uninstall -i <value> -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -1248,6 +1303,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1255,6 +1312,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Uninstall a ServiceNow application from your instance.
@@ -1287,7 +1346,7 @@ EXAMPLES
     $ nex app uninstall -i a1b2c3d4e5f6 -s x_my_custom_app -a dev-instance
 ```
-_See code: [src/commands/app/uninstall.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/app/uninstall.ts)_
+_See code: [src/commands/app/uninstall.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/app/uninstall.ts)_
 ## `nex atf`
@@ -1295,9 +1354,10 @@ Execute ATF (Automated Test Framework) tests or test suites on a ServiceNow inst
 ```
 USAGE
-  $ nex atf [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-t <value> | -s <value> | -n <value>] [-w] [-p <value>] [-b <value>]
-    [--browser-version <value>] [--os-name <value>] [--os-version <value>] [--performance] [--cloud]
+  $ nex atf [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-t <value> | -s <value> | -n <value>] [-w] [-p
+    <value>] [-b <value>] [--browser-version <value>] [--os-name <value>] [--os-version <value>] [--performance]
+    [--cloud]
 FLAGS
   -a, --auth=<value>             Auth alias to use.
@@ -1317,12 +1377,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Execute ATF (Automated Test Framework) tests or test suites on a ServiceNow instance.
@@ -1365,7 +1429,7 @@ EXAMPLES
     $ nex atf --suite-id e077e00b83103210621e78c6feaad383 --poll-interval 10000 --auth dev-instance
 ```
-_See code: [src/commands/atf/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/atf/index.ts)_
+_See code: [src/commands/atf/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/atf/index.ts)_
 ## `nex attachment get`
@@ -1373,8 +1437,8 @@ Get metadata for a specific attachment.
 ```
 USAGE
-  $ nex attachment get -s <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex attachment get -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -1383,6 +1447,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1390,6 +1456,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Get metadata for a specific attachment.
@@ -1404,7 +1472,7 @@ EXAMPLES
     $ nex attachment get -s att123 --json --auth dev
 ```
-_See code: [src/commands/attachment/get.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/attachment/get.ts)_
+_See code: [src/commands/attachment/get.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/attachment/get.ts)_
 ## `nex attachment list`
@@ -1412,8 +1480,8 @@ List attachments on a ServiceNow record.
 ```
 USAGE
-  $ nex attachment list -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--limit <value>]
+  $ nex attachment list -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--limit <value>]
 FLAGS
   -a, --auth=<value>       Auth alias to use.
@@ -1424,6 +1492,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1431,6 +1501,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   List attachments on a ServiceNow record.
@@ -1445,7 +1517,7 @@ EXAMPLES
     $ nex attachment list -t incident -r abc123 --limit 50 --json --auth dev
 ```
-_See code: [src/commands/attachment/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/attachment/list.ts)_
+_See code: [src/commands/attachment/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/attachment/list.ts)_
 ## `nex attachment upload`
@@ -1453,8 +1525,9 @@ Upload a file as an attachment to a ServiceNow record.
 ```
 USAGE
-  $ nex attachment upload -f <value> -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>]
-    [--log-file] [--log-level debug|warn|error|info|trace] [--content-type <value>]
+  $ nex attachment upload -f <value> -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
+    [--content-type <value>]
 FLAGS
   -a, --auth=<value>          Auth alias to use.
@@ -1466,6 +1539,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1473,6 +1548,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Upload a file as an attachment to a ServiceNow record.
@@ -1487,7 +1564,7 @@ EXAMPLES
     $ nex attachment upload -t incident -r abc123 -f ./data.csv --content-type text/csv --auth dev
 ```
-_See code: [src/commands/attachment/upload.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/attachment/upload.ts)_
+_See code: [src/commands/attachment/upload.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/attachment/upload.ts)_
 ## `nex auth delete [ALIAS]`
@@ -1522,7 +1599,7 @@ EXAMPLES
     $ nex auth delete --all
 ```
-_See code: [src/commands/auth/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/auth/delete.ts)_
+_See code: [src/commands/auth/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/auth/delete.ts)_
 ## `nex auth doctor`
@@ -1550,7 +1627,7 @@ EXAMPLES
     $ nex auth doctor --json
 ```
-_See code: [src/commands/auth/doctor.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/auth/doctor.ts)_
+_See code: [src/commands/auth/doctor.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/auth/doctor.ts)_
 ## `nex auth list`
@@ -1583,7 +1660,7 @@ EXAMPLES
     $ nex auth list --json
 ```
-_See code: [src/commands/auth/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/auth/list.ts)_
+_See code: [src/commands/auth/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/auth/list.ts)_
 ## `nex auth use ALIAS`
@@ -1611,7 +1688,7 @@ EXAMPLES
     $ nex auth use dev206299
 ```
-_See code: [src/commands/auth/use.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/auth/use.ts)_
+_See code: [src/commands/auth/use.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/auth/use.ts)_
 ## `nex autocomplete [SHELL]`
@@ -1642,7 +1719,7 @@ EXAMPLES
   $ nex autocomplete --refresh-cache
 ```
-_See code: [@oclif/plugin-autocomplete](https://github.com/oclif/plugin-autocomplete/blob/v3.2.54/src/commands/autocomplete/index.ts)_
+_See code: [@oclif/plugin-autocomplete](https://github.com/oclif/plugin-autocomplete/blob/v3.2.55/src/commands/autocomplete/index.ts)_
 ## `nex batch create`
@@ -1650,8 +1727,8 @@ Batch create records on a ServiceNow instance from a JSON file.
 ```
 USAGE
-  $ nex batch create -f <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--transaction]
+  $ nex batch create -f <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--transaction]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -1661,6 +1738,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1668,6 +1747,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Batch create records on a ServiceNow instance from a JSON file.
@@ -1682,7 +1763,7 @@ EXAMPLES
     $ nex batch create --file ./records.json --no-transaction --auth dev
 ```
-_See code: [src/commands/batch/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/batch/create.ts)_
+_See code: [src/commands/batch/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/batch/create.ts)_
 ## `nex batch update`
@@ -1690,8 +1771,8 @@ Batch update records on a ServiceNow instance from a JSON file.
 ```
 USAGE
-  $ nex batch update -f <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--stop-on-error]
+  $ nex batch update -f <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--stop-on-error]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -1701,6 +1782,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1708,6 +1791,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Batch update records on a ServiceNow instance from a JSON file.
@@ -1722,7 +1807,7 @@ EXAMPLES
     $ nex batch update --file ./updates.json --stop-on-error --auth dev
 ```
-_See code: [src/commands/batch/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/batch/update.ts)_
+_See code: [src/commands/batch/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/batch/update.ts)_
 ## `nex bulk delete`
@@ -1730,8 +1815,8 @@ Bulk delete records matching an encoded query.
 ```
 USAGE
-  $ nex bulk delete -t <value> -q <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--confirm] [-l <value>]
+  $ nex bulk delete -t <value> -q <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--confirm] [-l <value>]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -1744,12 +1829,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Bulk delete records matching an encoded query.
@@ -1782,7 +1871,7 @@ EXAMPLES
     $ nex bulk delete --table u_staging --query "processed=true" --confirm --json --auth dev
 ```
-_See code: [src/commands/bulk/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/bulk/delete.ts)_
+_See code: [src/commands/bulk/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/bulk/delete.ts)_
 ## `nex bulk update`
@@ -1790,8 +1879,9 @@ Bulk update records matching an encoded query.
 ```
 USAGE
-  $ nex bulk update -t <value> -q <value> -d <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>]
-    [--log-file] [--log-level debug|warn|error|info|trace] [--confirm] [-l <value>]
+  $ nex bulk update -t <value> -q <value> -d <value> [-j] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--confirm]
+    [-l <value>]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -1805,12 +1895,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Bulk update records matching an encoded query.
@@ -1846,7 +1940,7 @@ EXAMPLES
     $ nex bulk update --table incident --query "active=true" --data '{"state":"6"}' --confirm --json --auth dev
 ```
-_See code: [src/commands/bulk/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/bulk/update.ts)_
+_See code: [src/commands/bulk/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/bulk/update.ts)_
 ## `nex exec SCOPE [FILE]`
@@ -1854,8 +1948,8 @@ Execute JavaScript on a ServiceNow instance remotely using Scripts - Background.
 ```
 USAGE
-  $ nex exec SCOPE [FILE] [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [-p <value>]
+  $ nex exec SCOPE [FILE] [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-p <value>]
 ARGUMENTS
   SCOPE   Scope to execute script in. Use "global" for global scope.
@@ -1868,6 +1962,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1875,6 +1971,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Execute JavaScript on a ServiceNow instance remotely using Scripts - Background.
@@ -1972,7 +2070,7 @@ EXAMPLES
     $ nex exec global ./script.js --auth dev-instance --params '{"token":"abc123","env":"dev"}'
 ```
-_See code: [src/commands/exec/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/exec/index.ts)_
+_See code: [src/commands/exec/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/exec/index.ts)_
 ## `nex flow action`
@@ -1980,8 +2078,9 @@ Execute a Flow Designer action by scoped name.
 ```
 USAGE
-  $ nex flow action -n <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-i <value>] [-m foreground|background] [--scope <value>] [--quick]
+  $ nex flow action -n <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-i <value>] [-m
+    foreground|background] [--scope <value>] [--quick]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -1996,12 +2095,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Execute a Flow Designer action by scoped name.
@@ -2021,7 +2124,7 @@ EXAMPLES
       '{"table":"incident","values":{"short_description":"Test"}}' --auth dev
 ```
-_See code: [src/commands/flow/action.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/action.ts)_
+_See code: [src/commands/flow/action.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/action.ts)_
 ## `nex flow cancel`
@@ -2029,8 +2132,8 @@ Cancel a running or paused flow execution.
 ```
 USAGE
-  $ nex flow cancel -c <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-r <value>] [--scope <value>]
+  $ nex flow cancel -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-r <value>] [--scope <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2042,12 +2145,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Cancel a running or paused flow execution.
@@ -2064,7 +2171,7 @@ EXAMPLES
     $ nex flow cancel --context-id abc123def456 --reason "No longer needed" --auth dev
 ```
-_See code: [src/commands/flow/cancel.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/cancel.ts)_
+_See code: [src/commands/flow/cancel.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/cancel.ts)_
 ## `nex flow copy`
@@ -2072,8 +2179,8 @@ Copy an existing flow into a target scoped application.
 ```
 USAGE
-  $ nex flow copy -s <value> -n <value> -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>]
-    [--log-file] [--log-level debug|warn|error|info|trace]
+  $ nex flow copy -s <value> -n <value> -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -2086,12 +2193,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Copy an existing flow into a target scoped application.
@@ -2125,7 +2236,7 @@ EXAMPLES
       dev
 ```
-_See code: [src/commands/flow/copy.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/copy.ts)_
+_See code: [src/commands/flow/copy.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/copy.ts)_
 ## `nex flow details`
@@ -2133,8 +2244,8 @@ Get rich execution details for a flow context.
 ```
 USAGE
-  $ nex flow details -c <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--scope <value>] [-d]
+  $ nex flow details -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>] [-d]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2146,12 +2257,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Get rich execution details for a flow context.
@@ -2182,7 +2297,7 @@ EXAMPLES
     $ nex flow details -c d4e5f6789012345678abcdef01234567 --json --auth dev
 ```
-_See code: [src/commands/flow/details.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/details.ts)_
+_See code: [src/commands/flow/details.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/details.ts)_
 ## `nex flow error`
@@ -2190,8 +2305,8 @@ Retrieve error details from a failed flow execution.
 ```
 USAGE
-  $ nex flow error -c <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--scope <value>]
+  $ nex flow error -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2202,12 +2317,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Retrieve error details from a failed flow execution.
@@ -2220,7 +2339,7 @@ EXAMPLES
     $ nex flow error --context-id abc123def456 --auth dev
 ```
-_See code: [src/commands/flow/error.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/error.ts)_
+_See code: [src/commands/flow/error.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/error.ts)_
 ## `nex flow logs`
@@ -2228,8 +2347,8 @@ Retrieve flow execution log entries for a given context.
 ```
 USAGE
-  $ nex flow logs -c <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-l <value>] [-o asc|desc]
+  $ nex flow logs -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-l <value>] [-o asc|desc]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2242,12 +2361,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Retrieve flow execution log entries for a given context.
@@ -2274,7 +2397,7 @@ EXAMPLES
     $ nex flow logs -c d4e5f6789012345678abcdef01234567 --json --auth dev
 ```
-_See code: [src/commands/flow/logs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/logs.ts)_
+_See code: [src/commands/flow/logs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/logs.ts)_
 ## `nex flow message`
@@ -2282,8 +2405,9 @@ Send a message to a paused flow execution.
 ```
 USAGE
-  $ nex flow message -c <value> -m <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [-p <value>] [--scope <value>]
+  $ nex flow message -c <value> -m <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-p <value>] [--scope
+    <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2296,12 +2420,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Send a message to a paused flow execution.
@@ -2319,7 +2447,7 @@ EXAMPLES
     $ nex flow message --context-id abc123def456 --message "data_ready" --payload '{"status":"ok"}' --auth dev
 ```
-_See code: [src/commands/flow/message.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/message.ts)_
+_See code: [src/commands/flow/message.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/message.ts)_
 ## `nex flow outputs`
@@ -2327,8 +2455,8 @@ Retrieve outputs from a completed flow execution.
 ```
 USAGE
-  $ nex flow outputs -c <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--scope <value>]
+  $ nex flow outputs -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2339,12 +2467,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Retrieve outputs from a completed flow execution.
@@ -2361,7 +2493,7 @@ EXAMPLES
     $ nex flow outputs --context-id abc123def456 --json --auth dev
 ```
-_See code: [src/commands/flow/outputs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/outputs.ts)_
+_See code: [src/commands/flow/outputs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/outputs.ts)_
 ## `nex flow run`
@@ -2369,8 +2501,9 @@ Execute a published Flow Designer flow by scoped name.
 ```
 USAGE
-  $ nex flow run -n <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-i <value>] [-m foreground|background] [--scope <value>] [--quick]
+  $ nex flow run -n <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-i <value>] [-m
+    foreground|background] [--scope <value>] [--quick]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -2385,12 +2518,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Execute a published Flow Designer flow by scoped name.
@@ -2422,7 +2559,7 @@ EXAMPLES
     $ nex flow run --name global.my_flow --mode background --auth dev
 ```
-_See code: [src/commands/flow/run.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/run.ts)_
+_See code: [src/commands/flow/run.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/run.ts)_
 ## `nex flow status`
@@ -2430,8 +2567,8 @@ Get the status of a flow execution context.
 ```
 USAGE
-  $ nex flow status -c <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--scope <value>]
+  $ nex flow status -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2442,12 +2579,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Get the status of a flow execution context.
@@ -2462,7 +2603,7 @@ EXAMPLES
     $ nex flow status --context-id abc123def456 --auth dev
 ```
-_See code: [src/commands/flow/status.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/status.ts)_
+_See code: [src/commands/flow/status.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/status.ts)_
 ## `nex flow subflow`
@@ -2470,8 +2611,9 @@ Execute a published Flow Designer subflow by scoped name.
 ```
 USAGE
-  $ nex flow subflow -n <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-i <value>] [-m foreground|background] [--scope <value>] [--quick]
+  $ nex flow subflow -n <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-i <value>] [-m
+    foreground|background] [--scope <value>] [--quick]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -2486,12 +2628,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Execute a published Flow Designer subflow by scoped name.
@@ -2517,7 +2663,7 @@ EXAMPLES
     $ nex flow subflow --name x_myapp.process_record --inputs '{"table":"incident","sys_id":"abc123"}' --auth dev
 ```
-_See code: [src/commands/flow/subflow.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/subflow.ts)_
+_See code: [src/commands/flow/subflow.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/subflow.ts)_
 ## `nex flow test`
@@ -2525,8 +2671,9 @@ Test a Flow Designer flow without requiring it to be published.
 ```
 USAGE
-  $ nex flow test -f <value> -o <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--scope <value>] [--synchronous]
+  $ nex flow test -f <value> -o <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>]
+    [--synchronous]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2540,12 +2687,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Test a Flow Designer flow without requiring it to be published.
@@ -2575,7 +2726,7 @@ EXAMPLES
     $ nex flow test -f 887dda5583237210fdb8f7b6feaad32c -o '{"current":"abc123"}' --json --auth dev
 ```
-_See code: [src/commands/flow/test.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/test.ts)_
+_See code: [src/commands/flow/test.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/flow/test.ts)_
 ## `nex health check`
@@ -2583,9 +2734,9 @@ Run a consolidated health check on a ServiceNow instance.
 ```
 USAGE
-  $ nex health check [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--include-version] [--include-cluster] [--include-stuck-jobs] [--include-semaphores]
-    [--include-operational-counts] [--stuck-job-threshold <value>]
+  $ nex health check [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--include-version] [--include-cluster]
+    [--include-stuck-jobs] [--include-semaphores] [--include-operational-counts] [--stuck-job-threshold <value>]
 FLAGS
   -a, --auth=<value>                     Auth alias to use.
@@ -2600,12 +2751,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Run a consolidated health check on a ServiceNow instance.
@@ -2641,7 +2796,7 @@ EXAMPLES
     $ nex health check --json --auth dev
 ```
-_See code: [src/commands/health/check.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/health/check.ts)_
+_See code: [src/commands/health/check.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/health/check.ts)_
 ## `nex help [COMMAND]`
@@ -2661,7 +2816,7 @@ DESCRIPTION
   Display help for nex.
 ```
-_See code: [@oclif/plugin-help](https://github.com/oclif/plugin-help/blob/6.2.55/src/commands/help.ts)_
+_See code: [@oclif/plugin-help](https://github.com/oclif/plugin-help/blob/6.2.56/src/commands/help.ts)_
 ## `nex log`
@@ -2669,8 +2824,9 @@ Tail and monitor ServiceNow system logs in real-time with beautiful formatting.
 ```
 USAGE
-  $ nex log [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-o <value>] [-i <value>] [--no-color] [-f <value>...]
+  $ nex log [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-o <value>] [-i <value>] [--no-color] [-f
+    <value>...]
 FLAGS
   -a, --auth=<value>       Auth alias to use.
@@ -2685,6 +2841,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -2692,6 +2850,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Tail and monitor ServiceNow system logs in real-time with beautiful formatting.
@@ -2772,7 +2932,7 @@ EXAMPLES
     $ nex log --no-color --auth dev-instance
 ```
-_See code: [src/commands/log/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/log/index.ts)_
+_See code: [src/commands/log/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/log/index.ts)_
 ## `nex plugins`
@@ -3064,14 +3224,47 @@ DESCRIPTION
 _See code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/5.4.86/src/commands/plugins/update.ts)_
+## `nex policy status`
+Show what this invocation is permitted to change on the instance, and why.
+```
+USAGE
+  $ nex policy status [--json] [--deny-execute] [--deny-write] [--read-only]
+FLAGS
+  --deny-execute  Evaluate as if --deny-execute were passed.
+  --deny-write    Evaluate as if --deny-write were passed.
+  --read-only     Evaluate as if --read-only were passed.
+GLOBAL FLAGS
+  --json  Format output as json.
+DESCRIPTION
+  Show what this invocation is permitted to change on the instance, and why.
+  Changes are permitted by default. NEX_POLICY_DENY, set in the environment, outranks every command-line flag — that is
+  the only layer an agent driving this CLI cannot reach.
+EXAMPLES
+  $ nex policy status
+  $ nex policy status --read-only
+  NEX_POLICY_DENY=all nex policy status
+```
+_See code: [src/commands/policy/status.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/policy/status.ts)_
 ## `nex query`
 Query any ServiceNow table using the Table API.
 ```
 USAGE
-  $ nex query -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-q <value>] [-f <value>] [-d] [-l <value>]
+  $ nex query -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>] [-f <value>] [-d] [-l
+    <value>]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3085,12 +3278,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Query any ServiceNow table using the Table API.
@@ -3120,7 +3317,7 @@ EXAMPLES
     $ nex query --table sys_user --query "active=true" --limit 5 --json --auth dev
 ```
-_See code: [src/commands/query/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/query/index.ts)_
+_See code: [src/commands/query/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/query/index.ts)_
 ## `nex query app`
@@ -3128,8 +3325,8 @@ Search for applications by name across scoped apps and plugins.
 ```
 USAGE
-  $ nex query app -s <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-a] [-l <value>]
+  $ nex query app -s <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-a] [-l <value>]
 FLAGS
   -a, --active          Only show active applications
@@ -3141,12 +3338,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Search for applications by name across scoped apps and plugins.
@@ -3169,7 +3370,7 @@ EXAMPLES
     $ nex query app --search "HR" --active --auth dev
 ```
-_See code: [src/commands/query/app.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/query/app.ts)_
+_See code: [src/commands/query/app.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/query/app.ts)_
 ## `nex query columns`
@@ -3177,8 +3378,8 @@ List and search columns (fields) on a ServiceNow table.
 ```
 USAGE
-  $ nex query columns -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-s <value>]
+  $ nex query columns -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-s <value>]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3189,12 +3390,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   List and search columns (fields) on a ServiceNow table.
@@ -3220,7 +3425,7 @@ EXAMPLES
     $ nex query columns --table incident --json --auth dev
 ```
-_See code: [src/commands/query/columns.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/query/columns.ts)_
+_See code: [src/commands/query/columns.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/query/columns.ts)_
 ## `nex query syslog`
@@ -3228,8 +3433,8 @@ Query ServiceNow system logs (one-shot, non-tailing).
 ```
 USAGE
-  $ nex query syslog [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-q <value>] [-l <value>]
+  $ nex query syslog [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>] [-l <value>]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3240,12 +3445,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Query ServiceNow system logs (one-shot, non-tailing).
@@ -3273,7 +3482,7 @@ EXAMPLES
     $ nex query syslog --query "sourceLIKEincident" --json --auth dev
 ```
-_See code: [src/commands/query/syslog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/query/syslog.ts)_
+_See code: [src/commands/query/syslog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/query/syslog.ts)_
 ## `nex schema`
@@ -3281,9 +3490,9 @@ Discover and inspect a ServiceNow table schema including fields, types, and rela
 ```
 USAGE
-  $ nex schema -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--include-choices] [--include-relationships] [--include-ui-policies]
-    [--include-business-rules]
+  $ nex schema -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--include-choices]
+    [--include-relationships] [--include-ui-policies] [--include-business-rules]
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -3297,12 +3506,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Discover and inspect a ServiceNow table schema including fields, types, and relationships.
@@ -3328,7 +3541,7 @@ EXAMPLES
     $ nex schema --table incident --include-choices --include-relationships --auth dev
 ```
-_See code: [src/commands/schema/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/schema/index.ts)_
+_See code: [src/commands/schema/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/schema/index.ts)_
 ## `nex schema field`
@@ -3336,8 +3549,8 @@ Get detailed information about a specific field on a ServiceNow table.
 ```
 USAGE
-  $ nex schema field -t <value> -f <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace]
+  $ nex schema field -t <value> -f <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3348,12 +3561,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Get detailed information about a specific field on a ServiceNow table.
@@ -3371,7 +3588,7 @@ EXAMPLES
     $ nex schema field --table incident --field priority --json --auth dev
 ```
-_See code: [src/commands/schema/field.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/schema/field.ts)_
+_See code: [src/commands/schema/field.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/schema/field.ts)_
 ## `nex schema validate-catalog`
@@ -3379,8 +3596,8 @@ Validate a ServiceNow catalog item configuration for common issues.
 ```
 USAGE
-  $ nex schema validate-catalog -s <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex schema validate-catalog -s <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3390,12 +3607,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Validate a ServiceNow catalog item configuration for common issues.
@@ -3413,7 +3634,7 @@ EXAMPLES
     $ nex schema validate-catalog --sys-id a1b2c3d4e5f6 --json --auth dev
 ```
-_See code: [src/commands/schema/validate-catalog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/schema/validate-catalog.ts)_
+_See code: [src/commands/schema/validate-catalog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/schema/validate-catalog.ts)_
 ## `nex scope`
@@ -3421,8 +3642,8 @@ Get the current application scope or list available applications.
 ```
 USAGE
-  $ nex scope [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-l]
+  $ nex scope [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-l]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -3431,6 +3652,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3438,6 +3661,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Get the current application scope or list available applications.
@@ -3456,7 +3681,7 @@ EXAMPLES
     $ nex scope -l --json --auth dev
 ```
-_See code: [src/commands/scope/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/scope/index.ts)_
+_See code: [src/commands/scope/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/scope/index.ts)_
 ## `nex scope set`
@@ -3464,8 +3689,8 @@ Set the current application scope on a ServiceNow instance.
 ```
 USAGE
-  $ nex scope set -a <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex scope set -a <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --app-id=<value>  (required) 32-char sys_id of application
@@ -3474,6 +3699,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3481,6 +3708,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Set the current application scope on a ServiceNow instance.
@@ -3495,7 +3724,7 @@ EXAMPLES
     $ nex scope set -a abc123def456ghi789jkl012mno345pq --json --auth dev
 ```
-_See code: [src/commands/scope/set.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/scope/set.ts)_
+_See code: [src/commands/scope/set.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/scope/set.ts)_
 ## `nex script-sync pull`
@@ -3504,8 +3733,8 @@ Pull a script from a ServiceNow instance to a local file.
 ```
 USAGE
   $ nex script-sync pull -n <value> -t sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client
-    [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [-o
-    <value>]
+    [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>] [--log-file] [--log-level
+    debug|warn|error|info|trace] [--read-only] [-o <value>]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3517,6 +3746,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3524,6 +3755,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Pull a script from a ServiceNow instance to a local file.
@@ -3551,7 +3784,7 @@ EXAMPLES
     $ nex script-sync pull -n MyClientScript -t sys_script_client --json --auth dev-instance
 ```
-_See code: [src/commands/script-sync/pull.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/script-sync/pull.ts)_
+_See code: [src/commands/script-sync/pull.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/script-sync/pull.ts)_
 ## `nex script-sync push`
@@ -3560,8 +3793,8 @@ Push a local script file to a ServiceNow instance.
 ```
 USAGE
   $ nex script-sync push -n <value> -t sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client -f
-    <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+    <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>] [--log-file]
+    [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3573,6 +3806,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3580,6 +3815,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Push a local script file to a ServiceNow instance.
@@ -3608,7 +3845,7 @@ EXAMPLES
     $ nex script-sync push -n MyUIScript -t sys_ui_script -f ./scripts/ui-script.js --json --auth dev-instance
 ```
-_See code: [src/commands/script-sync/push.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/script-sync/push.ts)_
+_See code: [src/commands/script-sync/push.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/script-sync/push.ts)_
 ## `nex script-sync sync`
@@ -3616,8 +3853,9 @@ Synchronize all scripts in a directory with a ServiceNow instance.
 ```
 USAGE
-  $ nex script-sync sync -d <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-t sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client...]
+  $ nex script-sync sync -d <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-t
+    sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client...]
 FLAGS
   -a, --auth=<value>       Auth alias to use.
@@ -3628,6 +3866,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3635,6 +3875,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Synchronize all scripts in a directory with a ServiceNow instance.
@@ -3662,7 +3904,7 @@ EXAMPLES
     $ nex script-sync sync -d ./scripts --json --auth dev-instance
 ```
-_See code: [src/commands/script-sync/sync.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/script-sync/sync.ts)_
+_See code: [src/commands/script-sync/sync.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/script-sync/sync.ts)_
 ## `nex search`
@@ -3670,8 +3912,9 @@ Search platform code across a ServiceNow instance.
 ```
 USAGE
-  $ nex search -t <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-l <value>] [-s <value>] [-g <value>] [--table <value>]
+  $ nex search -t <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-l <value>] [-s <value>] [-g <value>]
+    [--table <value>]
 FLAGS
   -a, --auth=<value>          Auth alias to use.
@@ -3684,6 +3927,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3691,6 +3936,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Search platform code across a ServiceNow instance.
@@ -3724,7 +3971,7 @@ EXAMPLES
     $ nex search --term "GlideRecord" --limit 10 --json --auth dev-instance
 ```
-_See code: [src/commands/search/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/search/index.ts)_
+_See code: [src/commands/search/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/search/index.ts)_
 ## `nex search add-table`
@@ -3732,8 +3979,8 @@ Add a table to a code search group on a ServiceNow instance.
 ```
 USAGE
-  $ nex search add-table -f <value> -g <value> -t <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>]
-    [--log-file] [--log-level debug|warn|error|info|trace]
+  $ nex search add-table -f <value> -g <value> -t <value> [--json] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -3744,6 +3991,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3751,6 +4000,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Add a table to a code search group on a ServiceNow instance.
@@ -3780,7 +4031,7 @@ EXAMPLES
       dev-instance
 ```
-_See code: [src/commands/search/add-table.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/search/add-table.ts)_
+_See code: [src/commands/search/add-table.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/search/add-table.ts)_
 ## `nex search groups`
@@ -3788,8 +4039,8 @@ List all available code search groups on a ServiceNow instance.
 ```
 USAGE
-  $ nex search groups [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex search groups [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -3797,6 +4048,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3804,6 +4057,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   List all available code search groups on a ServiceNow instance.
@@ -3825,7 +4080,7 @@ EXAMPLES
     $ nex search groups --json --auth dev-instance
 ```
-_See code: [src/commands/search/groups.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/search/groups.ts)_
+_See code: [src/commands/search/groups.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/search/groups.ts)_
 ## `nex search tables`
@@ -3833,8 +4088,8 @@ List tables configured for a specific code search group.
 ```
 USAGE
-  $ nex search tables -g <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex search tables -g <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>          Auth alias to use.
@@ -3843,6 +4098,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3850,6 +4107,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   List tables configured for a specific code search group.
@@ -3872,7 +4131,7 @@ EXAMPLES
     $ nex search tables --search-group "Business Rules" --json --auth dev-instance
 ```
-_See code: [src/commands/search/tables.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/search/tables.ts)_
+_See code: [src/commands/search/tables.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/search/tables.ts)_
 ## `nex store install`
@@ -3880,8 +4139,9 @@ Install an application from the ServiceNow Store.
 ```
 USAGE
-  $ nex store install -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--demo-data] [--no-wait] [--poll-interval <value>] [--timeout <value>]
+  $ nex store install -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--demo-data] [--no-wait]
+    [--poll-interval <value>] [--timeout <value>]
 FLAGS
   -a, --app-id=<value>         (required) Store application sys_id
@@ -3895,6 +4155,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3902,6 +4164,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Install an application from the ServiceNow Store.
@@ -3920,7 +4184,7 @@ EXAMPLES
     $ nex store install -a abc123 -v 1.0.0 --demo-data --auth dev
 ```
-_See code: [src/commands/store/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/store/install.ts)_
+_See code: [src/commands/store/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/store/install.ts)_
 ## `nex store search`
@@ -3928,8 +4192,9 @@ Search for applications in the ServiceNow Store.
 ```
 USAGE
-  $ nex store search [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--limit <value>] [--tab available_for_you|installed|updates] [-t <value>]
+  $ nex store search [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--limit <value>] [--tab
+    available_for_you|installed|updates] [-t <value>]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3941,6 +4206,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3948,6 +4215,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Search for applications in the ServiceNow Store.
@@ -3966,7 +4235,7 @@ EXAMPLES
     $ nex store search --tab updates --limit 10 --auth dev
 ```
-_See code: [src/commands/store/search.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/store/search.ts)_
+_See code: [src/commands/store/search.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/store/search.ts)_
 ## `nex store update`
@@ -3974,8 +4243,9 @@ Update a ServiceNow Store application to a new version.
 ```
 USAGE
-  $ nex store update -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--no-wait] [--poll-interval <value>] [--timeout <value>]
+  $ nex store update -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--no-wait]
+    [--poll-interval <value>] [--timeout <value>]
 FLAGS
   -a, --app-id=<value>         (required) Store application sys_id
@@ -3988,6 +4258,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3995,6 +4267,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Update a ServiceNow Store application to a new version.
@@ -4013,7 +4287,7 @@ EXAMPLES
     $ nex store update -a abc123 -v 2.0.0 --timeout 3600000 --auth dev
 ```
-_See code: [src/commands/store/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/store/update.ts)_
+_See code: [src/commands/store/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/store/update.ts)_
 ## `nex store validate`
@@ -4021,8 +4295,8 @@ Validate a batch installation definition file.
 ```
 USAGE
-  $ nex store validate -f <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex store validate -f <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -4031,6 +4305,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4038,6 +4314,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Validate a batch installation definition file.
@@ -4048,7 +4326,7 @@ EXAMPLES
     $ nex store validate --file ./batch-definition.json --auth dev
 ```
-_See code: [src/commands/store/validate.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/store/validate.ts)_
+_See code: [src/commands/store/validate.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/store/validate.ts)_
 ## `nex task approve`
@@ -4056,8 +4334,8 @@ Approve a ServiceNow change request.
 ```
 USAGE
-  $ nex task approve -n <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-c <value>]
+  $ nex task approve -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-c <value>]
 FLAGS
   -a, --auth=<value>      Auth alias to use.
@@ -4067,6 +4345,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4074,6 +4354,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Approve a ServiceNow change request.
@@ -4095,7 +4377,7 @@ EXAMPLES
     $ nex task approve -n CHG0010001 -c "Looks good, approved" --auth dev
 ```
-_See code: [src/commands/task/approve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/task/approve.ts)_
+_See code: [src/commands/task/approve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/task/approve.ts)_
 ## `nex task assign`
@@ -4103,8 +4385,9 @@ Assign a ServiceNow task to a user or group.
 ```
 USAGE
-  $ nex task assign -n <value> -u <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [-g <value>] [--table <value>]
+  $ nex task assign -n <value> -u <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-g <value>] [--table
+    <value>]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4116,6 +4399,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4123,6 +4408,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Assign a ServiceNow task to a user or group.
@@ -4151,7 +4438,7 @@ EXAMPLES
     $ nex task assign --number CHG0010001 --table change_request --user admin --auth dev
 ```
-_See code: [src/commands/task/assign.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/task/assign.ts)_
+_See code: [src/commands/task/assign.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/task/assign.ts)_
 ## `nex task close`
@@ -4159,8 +4446,9 @@ Close a ServiceNow incident.
 ```
 USAGE
-  $ nex task close --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>]
-    [--log-file] [--log-level debug|warn|error|info|trace] [--close-code <value>]
+  $ nex task close --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
+    [--close-code <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -4171,6 +4459,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4178,6 +4468,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Close a ServiceNow incident.
@@ -4200,7 +4492,7 @@ EXAMPLES
     $ nex task close -n INC0010001 --notes "Closed" --close-code "Solved (Permanently)" --auth dev
 ```
-_See code: [src/commands/task/close.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/task/close.ts)_
+_See code: [src/commands/task/close.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/task/close.ts)_
 ## `nex task comment`
@@ -4208,8 +4500,9 @@ Add a comment or work note to a ServiceNow task.
 ```
 USAGE
-  $ nex task comment -c <value> -n <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--table <value>] [--work-note]
+  $ nex task comment -c <value> -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--table <value>]
+    [--work-note]
 FLAGS
   -a, --auth=<value>     Auth alias to use.
@@ -4221,6 +4514,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4228,6 +4523,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Add a comment or work note to a ServiceNow task.
@@ -4255,7 +4552,7 @@ EXAMPLES
     $ nex task comment --number CHG0010001 --table change_request --comment "Approved" --auth dev
 ```
-_See code: [src/commands/task/comment.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/task/comment.ts)_
+_See code: [src/commands/task/comment.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/task/comment.ts)_
 ## `nex task find`
@@ -4263,8 +4560,8 @@ Find a ServiceNow task by its number.
 ```
 USAGE
-  $ nex task find -n <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--table <value>]
+  $ nex task find -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--table <value>]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4274,6 +4571,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4281,6 +4580,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Find a ServiceNow task by its number.
@@ -4307,7 +4608,7 @@ EXAMPLES
     $ nex task find -n INC0010001 --json --auth dev
 ```
-_See code: [src/commands/task/find.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/task/find.ts)_
+_See code: [src/commands/task/find.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/task/find.ts)_
 ## `nex task resolve`
@@ -4315,8 +4616,9 @@ Resolve a ServiceNow incident with resolution notes.
 ```
 USAGE
-  $ nex task resolve --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>]
-    [--log-file] [--log-level debug|warn|error|info|trace] [--close-code <value>]
+  $ nex task resolve --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
+    [--close-code <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -4327,6 +4629,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4334,6 +4638,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Resolve a ServiceNow incident with resolution notes.
@@ -4356,7 +4662,7 @@ EXAMPLES
     $ nex task resolve -n INC0010001 --notes "Fixed" --close-code "Solved (Permanently)" --auth dev
 ```
-_See code: [src/commands/task/resolve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/task/resolve.ts)_
+_See code: [src/commands/task/resolve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/task/resolve.ts)_
 ## `nex update-set`
@@ -4364,8 +4670,8 @@ List update sets on a ServiceNow instance.
 ```
 USAGE
-  $ nex update-set [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--limit <value>] [-q <value>]
+  $ nex update-set [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--limit <value>] [-q <value>]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -4375,6 +4681,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4382,6 +4690,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   List update sets on a ServiceNow instance.
@@ -4400,7 +4710,7 @@ EXAMPLES
     $ nex update-set --json --auth dev-instance
 ```
-_See code: [src/commands/update-set/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/update-set/index.ts)_
+_See code: [src/commands/update-set/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/update-set/index.ts)_
 ## `nex update-set clone`
@@ -4408,8 +4718,8 @@ Clone an update set and its records.
 ```
 USAGE
-  $ nex update-set clone -n <value> -s <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace]
+  $ nex update-set clone -n <value> -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4419,6 +4729,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4426,6 +4738,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Clone an update set and its records.
@@ -4440,7 +4754,7 @@ EXAMPLES
     $ nex update-set clone --source us-001 --name "Cloned Set" --json --auth dev-instance
 ```
-_See code: [src/commands/update-set/clone.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/update-set/clone.ts)_
+_See code: [src/commands/update-set/clone.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/update-set/clone.ts)_
 ## `nex update-set create`
@@ -4448,8 +4762,8 @@ Create a new update set.
 ```
 USAGE
-  $ nex update-set create -n <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--application <value>] [-d <value>]
+  $ nex update-set create -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--application <value>] [-d <value>]
 FLAGS
   -a, --auth=<value>         Auth alias to use.
@@ -4460,6 +4774,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4467,6 +4783,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Create a new update set.
@@ -4485,7 +4803,7 @@ EXAMPLES
     $ nex update-set create --name "My Feature Set" --application x_my_app --auth dev-instance
 ```
-_See code: [src/commands/update-set/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/update-set/create.ts)_
+_See code: [src/commands/update-set/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/update-set/create.ts)_
 ## `nex update-set current`
@@ -4493,8 +4811,8 @@ Get or set the current update set.
 ```
 USAGE
-  $ nex update-set current [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-s <value>]
+  $ nex update-set current [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-s <value>]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -4503,6 +4821,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4510,6 +4830,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Get or set the current update set.
@@ -4528,7 +4850,7 @@ EXAMPLES
     $ nex update-set current --json --auth dev-instance
 ```
-_See code: [src/commands/update-set/current.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/update-set/current.ts)_
+_See code: [src/commands/update-set/current.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/update-set/current.ts)_
 ## `nex update-set inspect`
@@ -4536,8 +4858,8 @@ Inspect the components of an update set.
 ```
 USAGE
-  $ nex update-set inspect -s <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex update-set inspect -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4546,6 +4868,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4553,6 +4877,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Inspect the components of an update set.
@@ -4567,7 +4893,7 @@ EXAMPLES
     $ nex update-set inspect --sys-id us-001 --json --auth dev-instance
 ```
-_See code: [src/commands/update-set/inspect.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/update-set/inspect.ts)_
+_See code: [src/commands/update-set/inspect.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/update-set/inspect.ts)_
 ## `nex update-set move`
@@ -4575,8 +4901,9 @@ Move records between update sets.
 ```
 USAGE
-  $ nex update-set move --target <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--records <value>] [--source <value>]
+  $ nex update-set move --target <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--records <value>]
+    [--source <value>]
 FLAGS
   -a, --auth=<value>     Auth alias to use.
@@ -4587,6 +4914,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4594,6 +4923,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Move records between update sets.
@@ -4612,7 +4943,7 @@ EXAMPLES
     $ nex update-set move --target us-002 --source us-001 --json --auth dev-instance
 ```
-_See code: [src/commands/update-set/move.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/update-set/move.ts)_
+_See code: [src/commands/update-set/move.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/update-set/move.ts)_
 ## `nex workflow create`
@@ -4620,8 +4951,8 @@ Create a complete workflow from a JSON specification file.
 ```
 USAGE
-  $ nex workflow create -s <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex workflow create -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -4630,6 +4961,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4637,6 +4970,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Create a complete workflow from a JSON specification file.
@@ -4651,7 +4986,7 @@ EXAMPLES
     $ nex workflow create -s ./workflow.json --json --auth dev
 ```
-_See code: [src/commands/workflow/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/workflow/create.ts)_
+_See code: [src/commands/workflow/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/workflow/create.ts)_
 ## `nex workflow publish`
@@ -4659,8 +4994,8 @@ Publish a workflow version.
 ```
 USAGE
-  $ nex workflow publish -s <value> -v <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace]
+  $ nex workflow publish -s <value> -v <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -4670,6 +5005,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4677,6 +5014,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Publish a workflow version.
@@ -4691,7 +5030,7 @@ EXAMPLES
     $ nex workflow publish -v wfv-001 -s act-001 --json --auth dev
 ```
-_See code: [src/commands/workflow/publish.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/workflow/publish.ts)_
+_See code: [src/commands/workflow/publish.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/workflow/publish.ts)_
 ## `nex xml export`
@@ -4699,8 +5038,8 @@ Export a single ServiceNow record as XML.
 ```
 USAGE
-  $ nex xml export -t <value> -s <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [-o <value>]
+  $ nex xml export -t <value> -s <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-o <value>]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4712,12 +5051,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Export a single ServiceNow record as XML.
@@ -4745,7 +5088,7 @@ EXAMPLES
     $ nex xml export --table sys_script --sys-id abc123 --json --auth dev
 ```
-_See code: [src/commands/xml/export.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/xml/export.ts)_
+_See code: [src/commands/xml/export.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/xml/export.ts)_
 ## `nex xml import`
@@ -4753,8 +5096,8 @@ Import XML records into a ServiceNow instance.
 ```
 USAGE
-  $ nex xml import -f <value> -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace]
+  $ nex xml import -f <value> -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -4765,12 +5108,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 DESCRIPTION
   Import XML records into a ServiceNow instance.
@@ -4793,7 +5140,7 @@ EXAMPLES
     $ nex xml import --file ./records.xml --table incident --json --auth dev
 ```
-_See code: [src/commands/xml/import.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/xml/import.ts)_
+_See code: [src/commands/xml/import.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.2.0/src/commands/xml/import.ts)_
 <!-- commandsstop -->
 ---