@sonisoft/now-sdk-ext-cli 5.1.0 → 5.3.0

package/README.md

@@ -505,6 +505,19 @@ nex flow cancel --context-id ctx-abc123 --reason "No longer needed" --auth dev
 
 # Send a message to a waiting flow (e.g., approval)
 nex flow message --context-id ctx-abc123 --message approved --payload '{"approver":"admin"}' --auth dev
+
+# Read a flow's design-time definition (nothing is executed; no context is created)
+nex flow definition --sys-id 887dda5583237210fdb8f7b6feaad32c --auth dev
+
+# Read a subflow definition
+nex flow definition -i 887dda5583237210fdb8f7b6feaad32c --type subflow --auth dev
+
+# Read a custom action definition with its ordered steps
+nex flow definition -i 887dda5583237210fdb8f7b6feaad32c --type action --auth dev
+
+# Redirect the full JSON definition to a file, or pipe it into another tool
+nex flow definition -i 887dda5583237210fdb8f7b6feaad32c --json --auth dev > flow.json
+nex flow definition -i 887dda5583237210fdb8f7b6feaad32c --type action --json --auth dev | jq .summary.steps
 ```
 
 **Features:**
@@ -512,6 +525,8 @@ nex flow message --context-id ctx-abc123 --message approved --payload '{"approve
 - Foreground (wait) or background execution modes
 - Query flow context status, outputs, and errors
 - Cancel running flows and send messages to paused flows
+- Read design-time definitions of flows, subflows, and actions — read-only, and
+  distinct from `flow details`, which reports on one past execution
 - JSON output for automation and CI/CD
 
 ### Bulk Record Operations
@@ -591,6 +606,10 @@ nex bulk update --table incident --query "state=7" --data '{"active":"false"}' -
 * [Check for errors](#check-for-errors)
 * [Cancel a running flow](#cancel-a-running-flow)
 * [Send a message to a waiting flow (e.g., approval)](#send-a-message-to-a-waiting-flow-eg-approval)
+* [Read a flow's design-time definition (nothing is executed; no context is created)](#read-a-flows-design-time-definition-nothing-is-executed-no-context-is-created)
+* [Read a subflow definition](#read-a-subflow-definition)
+* [Read a custom action definition with its ordered steps](#read-a-custom-action-definition-with-its-ordered-steps)
+* [Redirect the full JSON definition to a file, or pipe it into another tool](#redirect-the-full-json-definition-to-a-file-or-pipe-it-into-another-tool)
 * [Dry-run: preview which records would be updated (safe default)](#dry-run-preview-which-records-would-be-updated-safe-default)
 * [Confirm bulk update (actually modifies records)](#confirm-bulk-update-actually-modifies-records)
 * [Dry-run: preview which records would be deleted](#dry-run-preview-which-records-would-be-deleted)
@@ -689,7 +708,7 @@ $ npm install -g @sonisoft/now-sdk-ext-cli
 $ nex COMMAND
 running command...
 $ nex (--version)
-@sonisoft/now-sdk-ext-cli/5.1.0 linux-x64 node-v26.5.0
+@sonisoft/now-sdk-ext-cli/5.3.0 linux-x64 node-v26.5.0
 $ nex --help [COMMAND]
 USAGE
   $ nex COMMAND
@@ -697,6 +716,31 @@ USAGE
 ```
 <!-- usagestop -->
 
+
+## Restricting what can be changed
+
+Changes to a ServiceNow instance are **permitted by default**. Two ways to take that
+away, in priority order:
+
+| | | Reachable by an agent? |
+|---|---|---|
+| `NEX_POLICY_DENY=write,execute` (or `all`) | environment | **No** |
+| `--read-only`, `--deny-write`, `--deny-execute` | per invocation | Yes |
+
+Reads are never gated. `nex policy status` prints what is permitted and which layer
+decided — use it first when something is refused, since the fix differs completely
+between an environment variable and a flag.
+
+A malformed value **fails closed**: `NEX_POLICY_DENY=wrtie` denies everything and warns,
+rather than silently denying nothing.
+
+> `NEX_POLICY_DENY` holds only when set somewhere an agent cannot write — a shell
+> profile, a systemd unit, or a container environment. **Not** a committed `.env` or a
+> project-local config file, which anything with file access can edit.
+>
+> This is a guardrail, not a security boundary. Anything holding the credential can
+> reach the instance directly.
+
 # Commands
 <!-- commands -->
 * [`nex aggregate count`](#nex-aggregate-count)
@@ -724,6 +768,7 @@ USAGE
 * [`nex flow action`](#nex-flow-action)
 * [`nex flow cancel`](#nex-flow-cancel)
 * [`nex flow copy`](#nex-flow-copy)
+* [`nex flow definition`](#nex-flow-definition)
 * [`nex flow details`](#nex-flow-details)
 * [`nex flow error`](#nex-flow-error)
 * [`nex flow logs`](#nex-flow-logs)
@@ -746,6 +791,7 @@ USAGE
 * [`nex plugins uninstall [PLUGIN]`](#nex-plugins-uninstall-plugin)
 * [`nex plugins unlink [PLUGIN]`](#nex-plugins-unlink-plugin)
 * [`nex plugins update`](#nex-plugins-update)
+* [`nex policy status`](#nex-policy-status)
 * [`nex query`](#nex-query)
 * [`nex query app`](#nex-query-app)
 * [`nex query columns`](#nex-query-columns)
@@ -789,8 +835,8 @@ Count records in a ServiceNow table.
 
 ```
 USAGE
-  $ nex aggregate count -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-q <value>]
+  $ nex aggregate count -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -801,12 +847,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Count records in a ServiceNow table.
@@ -832,7 +882,7 @@ EXAMPLES
     $ nex aggregate count --table incident --query "active=true" --json --auth dev
 ```
 
-_See code: [src/commands/aggregate/count.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/aggregate/count.ts)_
+_See code: [src/commands/aggregate/count.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/aggregate/count.ts)_
 
 ## `nex aggregate group`
 
@@ -840,9 +890,9 @@ Run a grouped aggregate query on a ServiceNow table.
 
 ```
 USAGE
-  $ nex aggregate group -t <value> -g <value>... [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [-q <value>] [-c] [--avg <value>...] [--min <value>...] [--max <value>...]
-    [--sum <value>...] [--having <value>] [-d]
+  $ nex aggregate group -t <value> -g <value>... [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>] [-c] [--avg
+    <value>...] [--min <value>...] [--max <value>...] [--sum <value>...] [--having <value>] [-d]
 
 FLAGS
   -a, --auth=<value>         Auth alias to use.
@@ -861,12 +911,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Run a grouped aggregate query on a ServiceNow table.
@@ -896,7 +950,7 @@ EXAMPLES
     $ nex aggregate group --table incident --group-by priority --count --having "count>10" --auth dev
 ```
 
-_See code: [src/commands/aggregate/group.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/aggregate/group.ts)_
+_See code: [src/commands/aggregate/group.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/aggregate/group.ts)_
 
 ## `nex aggregate query`
 
@@ -904,9 +958,9 @@ Run aggregate statistics on a ServiceNow table.
 
 ```
 USAGE
-  $ nex aggregate query -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-q <value>] [-c] [--avg <value>...] [--min <value>...] [--max <value>...] [--sum
-    <value>...]
+  $ nex aggregate query -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>] [-c] [--avg <value>...]
+    [--min <value>...] [--max <value>...] [--sum <value>...]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -922,12 +976,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Run aggregate statistics on a ServiceNow table.
@@ -955,7 +1013,7 @@ EXAMPLES
     $ nex aggregate query --table incident --sum reassignment_count --json --auth dev
 ```
 
-_See code: [src/commands/aggregate/query.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/aggregate/query.ts)_
+_See code: [src/commands/aggregate/query.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/aggregate/query.ts)_
 
 ## `nex app`
 
@@ -963,8 +1021,8 @@ Manage ServiceNow applications: uninstall applications from your instance.
 
 ```
 USAGE
-  $ nex app [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-u] [-i <value>] [-s <value>]
+  $ nex app [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-u] [-i <value>] [-s <value>]
 
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -975,6 +1033,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -982,6 +1042,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Manage ServiceNow applications: uninstall applications from your instance.
@@ -1014,7 +1076,7 @@ EXAMPLES
     $ nex app -u -i a1b2c3d4e5f6 -s x_my_custom_app -a dev-instance
 ```
 
-_See code: [src/commands/app/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/app/index.ts)_
+_See code: [src/commands/app/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/app/index.ts)_
 
 ## `nex app install`
 
@@ -1022,8 +1084,8 @@ Install or upgrade multiple ServiceNow applications from a batch definition file
 
 ```
 USAGE
-  $ nex app install [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-b] [-d <value>]
+  $ nex app install [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-b] [-d <value>]
 
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -1033,6 +1095,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1040,6 +1104,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Install or upgrade multiple ServiceNow applications from a batch definition file.
@@ -1078,7 +1144,7 @@ EXAMPLES
     $ nex app install -b -d ./apps.json -a dev-instance --log-level debug
 ```
 
-_See code: [src/commands/app/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/app/install.ts)_
+_See code: [src/commands/app/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/app/install.ts)_
 
 ## `nex app repo-install`
 
@@ -1086,8 +1152,9 @@ Install an application from your ServiceNow company repository.
 
 ```
 USAGE
-  $ nex app repo-install -s <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-w] [--poll-interval <value>] [-t <value>] [-v <value>]
+  $ nex app repo-install -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-w] [--poll-interval <value>] [-t
+    <value>] [-v <value>]
 
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -1100,6 +1167,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1107,6 +1176,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Install an application from your ServiceNow company repository.
@@ -1158,7 +1229,7 @@ EXAMPLES
     $ nex app repo-install -s x_my_app -a dev-instance --log-level debug
 ```
 
-_See code: [src/commands/app/repo-install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/app/repo-install.ts)_
+_See code: [src/commands/app/repo-install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/app/repo-install.ts)_
 
 ## `nex app repo-list`
 
@@ -1166,8 +1237,8 @@ List applications available in your ServiceNow company repository.
 
 ```
 USAGE
-  $ nex app repo-list [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-n] [-i]
+  $ nex app repo-list [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-n] [-i]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -1178,12 +1249,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   List applications available in your ServiceNow company repository.
@@ -1229,7 +1304,7 @@ EXAMPLES
     $ nex app repo-list -a dev-instance
 ```
 
-_See code: [src/commands/app/repo-list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/app/repo-list.ts)_
+_See code: [src/commands/app/repo-list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/app/repo-list.ts)_
 
 ## `nex app uninstall`
 
@@ -1237,8 +1312,8 @@ Uninstall a ServiceNow application from your instance.
 
 ```
 USAGE
-  $ nex app uninstall -i <value> -s <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace]
+  $ nex app uninstall -i <value> -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -1248,6 +1323,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1255,6 +1332,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Uninstall a ServiceNow application from your instance.
@@ -1287,7 +1366,7 @@ EXAMPLES
     $ nex app uninstall -i a1b2c3d4e5f6 -s x_my_custom_app -a dev-instance
 ```
 
-_See code: [src/commands/app/uninstall.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/app/uninstall.ts)_
+_See code: [src/commands/app/uninstall.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/app/uninstall.ts)_
 
 ## `nex atf`
 
@@ -1295,9 +1374,10 @@ Execute ATF (Automated Test Framework) tests or test suites on a ServiceNow inst
 
 ```
 USAGE
-  $ nex atf [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-t <value> | -s <value> | -n <value>] [-w] [-p <value>] [-b <value>]
-    [--browser-version <value>] [--os-name <value>] [--os-version <value>] [--performance] [--cloud]
+  $ nex atf [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-t <value> | -s <value> | -n <value>] [-w] [-p
+    <value>] [-b <value>] [--browser-version <value>] [--os-name <value>] [--os-version <value>] [--performance]
+    [--cloud]
 
 FLAGS
   -a, --auth=<value>             Auth alias to use.
@@ -1317,12 +1397,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Execute ATF (Automated Test Framework) tests or test suites on a ServiceNow instance.
@@ -1365,7 +1449,7 @@ EXAMPLES
     $ nex atf --suite-id e077e00b83103210621e78c6feaad383 --poll-interval 10000 --auth dev-instance
 ```
 
-_See code: [src/commands/atf/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/atf/index.ts)_
+_See code: [src/commands/atf/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/atf/index.ts)_
 
 ## `nex attachment get`
 
@@ -1373,8 +1457,8 @@ Get metadata for a specific attachment.
 
 ```
 USAGE
-  $ nex attachment get -s <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex attachment get -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -1383,6 +1467,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1390,6 +1476,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Get metadata for a specific attachment.
@@ -1404,7 +1492,7 @@ EXAMPLES
     $ nex attachment get -s att123 --json --auth dev
 ```
 
-_See code: [src/commands/attachment/get.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/attachment/get.ts)_
+_See code: [src/commands/attachment/get.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/attachment/get.ts)_
 
 ## `nex attachment list`
 
@@ -1412,8 +1500,8 @@ List attachments on a ServiceNow record.
 
 ```
 USAGE
-  $ nex attachment list -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--limit <value>]
+  $ nex attachment list -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--limit <value>]
 
 FLAGS
   -a, --auth=<value>       Auth alias to use.
@@ -1424,6 +1512,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1431,6 +1521,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   List attachments on a ServiceNow record.
@@ -1445,7 +1537,7 @@ EXAMPLES
     $ nex attachment list -t incident -r abc123 --limit 50 --json --auth dev
 ```
 
-_See code: [src/commands/attachment/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/attachment/list.ts)_
+_See code: [src/commands/attachment/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/attachment/list.ts)_
 
 ## `nex attachment upload`
 
@@ -1453,8 +1545,9 @@ Upload a file as an attachment to a ServiceNow record.
 
 ```
 USAGE
-  $ nex attachment upload -f <value> -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>]
-    [--log-file] [--log-level debug|warn|error|info|trace] [--content-type <value>]
+  $ nex attachment upload -f <value> -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
+    [--content-type <value>]
 
 FLAGS
   -a, --auth=<value>          Auth alias to use.
@@ -1466,6 +1559,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1473,6 +1568,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Upload a file as an attachment to a ServiceNow record.
@@ -1487,7 +1584,7 @@ EXAMPLES
     $ nex attachment upload -t incident -r abc123 -f ./data.csv --content-type text/csv --auth dev
 ```
 
-_See code: [src/commands/attachment/upload.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/attachment/upload.ts)_
+_See code: [src/commands/attachment/upload.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/attachment/upload.ts)_
 
 ## `nex auth delete [ALIAS]`
 
@@ -1522,7 +1619,7 @@ EXAMPLES
     $ nex auth delete --all
 ```
 
-_See code: [src/commands/auth/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/auth/delete.ts)_
+_See code: [src/commands/auth/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/auth/delete.ts)_
 
 ## `nex auth doctor`
 
@@ -1550,7 +1647,7 @@ EXAMPLES
     $ nex auth doctor --json
 ```
 
-_See code: [src/commands/auth/doctor.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/auth/doctor.ts)_
+_See code: [src/commands/auth/doctor.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/auth/doctor.ts)_
 
 ## `nex auth list`
 
@@ -1583,7 +1680,7 @@ EXAMPLES
     $ nex auth list --json
 ```
 
-_See code: [src/commands/auth/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/auth/list.ts)_
+_See code: [src/commands/auth/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/auth/list.ts)_
 
 ## `nex auth use ALIAS`
 
@@ -1611,7 +1708,7 @@ EXAMPLES
     $ nex auth use dev206299
 ```
 
-_See code: [src/commands/auth/use.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/auth/use.ts)_
+_See code: [src/commands/auth/use.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/auth/use.ts)_
 
 ## `nex autocomplete [SHELL]`
 
@@ -1642,7 +1739,7 @@ EXAMPLES
   $ nex autocomplete --refresh-cache
 ```
 
-_See code: [@oclif/plugin-autocomplete](https://github.com/oclif/plugin-autocomplete/blob/v3.2.54/src/commands/autocomplete/index.ts)_
+_See code: [@oclif/plugin-autocomplete](https://github.com/oclif/plugin-autocomplete/blob/v3.2.55/src/commands/autocomplete/index.ts)_
 
 ## `nex batch create`
 
@@ -1650,8 +1747,8 @@ Batch create records on a ServiceNow instance from a JSON file.
 
 ```
 USAGE
-  $ nex batch create -f <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--transaction]
+  $ nex batch create -f <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--transaction]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -1661,6 +1758,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1668,6 +1767,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Batch create records on a ServiceNow instance from a JSON file.
@@ -1682,7 +1783,7 @@ EXAMPLES
     $ nex batch create --file ./records.json --no-transaction --auth dev
 ```
 
-_See code: [src/commands/batch/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/batch/create.ts)_
+_See code: [src/commands/batch/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/batch/create.ts)_
 
 ## `nex batch update`
 
@@ -1690,8 +1791,8 @@ Batch update records on a ServiceNow instance from a JSON file.
 
 ```
 USAGE
-  $ nex batch update -f <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--stop-on-error]
+  $ nex batch update -f <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--stop-on-error]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -1701,6 +1802,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1708,6 +1811,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Batch update records on a ServiceNow instance from a JSON file.
@@ -1722,7 +1827,7 @@ EXAMPLES
     $ nex batch update --file ./updates.json --stop-on-error --auth dev
 ```
 
-_See code: [src/commands/batch/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/batch/update.ts)_
+_See code: [src/commands/batch/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/batch/update.ts)_
 
 ## `nex bulk delete`
 
@@ -1730,8 +1835,8 @@ Bulk delete records matching an encoded query.
 
 ```
 USAGE
-  $ nex bulk delete -t <value> -q <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--confirm] [-l <value>]
+  $ nex bulk delete -t <value> -q <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--confirm] [-l <value>]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -1744,12 +1849,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Bulk delete records matching an encoded query.
@@ -1782,7 +1891,7 @@ EXAMPLES
     $ nex bulk delete --table u_staging --query "processed=true" --confirm --json --auth dev
 ```
 
-_See code: [src/commands/bulk/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/bulk/delete.ts)_
+_See code: [src/commands/bulk/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/bulk/delete.ts)_
 
 ## `nex bulk update`
 
@@ -1790,8 +1899,9 @@ Bulk update records matching an encoded query.
 
 ```
 USAGE
-  $ nex bulk update -t <value> -q <value> -d <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>]
-    [--log-file] [--log-level debug|warn|error|info|trace] [--confirm] [-l <value>]
+  $ nex bulk update -t <value> -q <value> -d <value> [-j] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--confirm]
+    [-l <value>]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -1805,12 +1915,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Bulk update records matching an encoded query.
@@ -1846,7 +1960,7 @@ EXAMPLES
     $ nex bulk update --table incident --query "active=true" --data '{"state":"6"}' --confirm --json --auth dev
 ```
 
-_See code: [src/commands/bulk/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/bulk/update.ts)_
+_See code: [src/commands/bulk/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/bulk/update.ts)_
 
 ## `nex exec SCOPE [FILE]`
 
@@ -1854,8 +1968,8 @@ Execute JavaScript on a ServiceNow instance remotely using Scripts - Background.
 
 ```
 USAGE
-  $ nex exec SCOPE [FILE] [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [-p <value>]
+  $ nex exec SCOPE [FILE] [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-p <value>]
 
 ARGUMENTS
   SCOPE   Scope to execute script in. Use "global" for global scope.
@@ -1868,6 +1982,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -1875,6 +1991,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Execute JavaScript on a ServiceNow instance remotely using Scripts - Background.
@@ -1972,7 +2090,7 @@ EXAMPLES
     $ nex exec global ./script.js --auth dev-instance --params '{"token":"abc123","env":"dev"}'
 ```
 
-_See code: [src/commands/exec/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/exec/index.ts)_
+_See code: [src/commands/exec/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/exec/index.ts)_
 
 ## `nex flow action`
 
@@ -1980,8 +2098,9 @@ Execute a Flow Designer action by scoped name.
 
 ```
 USAGE
-  $ nex flow action -n <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-i <value>] [-m foreground|background] [--scope <value>] [--quick]
+  $ nex flow action -n <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-i <value>] [-m
+    foreground|background] [--scope <value>] [--quick]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -1996,12 +2115,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Execute a Flow Designer action by scoped name.
@@ -2021,7 +2144,7 @@ EXAMPLES
       '{"table":"incident","values":{"short_description":"Test"}}' --auth dev
 ```
 
-_See code: [src/commands/flow/action.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/action.ts)_
+_See code: [src/commands/flow/action.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/action.ts)_
 
 ## `nex flow cancel`
 
@@ -2029,8 +2152,8 @@ Cancel a running or paused flow execution.
 
 ```
 USAGE
-  $ nex flow cancel -c <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-r <value>] [--scope <value>]
+  $ nex flow cancel -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-r <value>] [--scope <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2042,12 +2165,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Cancel a running or paused flow execution.
@@ -2064,7 +2191,7 @@ EXAMPLES
     $ nex flow cancel --context-id abc123def456 --reason "No longer needed" --auth dev
 ```
 
-_See code: [src/commands/flow/cancel.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/cancel.ts)_
+_See code: [src/commands/flow/cancel.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/cancel.ts)_
 
 ## `nex flow copy`
 
@@ -2072,8 +2199,8 @@ Copy an existing flow into a target scoped application.
 
 ```
 USAGE
-  $ nex flow copy -s <value> -n <value> -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>]
-    [--log-file] [--log-level debug|warn|error|info|trace]
+  $ nex flow copy -s <value> -n <value> -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -2086,12 +2213,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Copy an existing flow into a target scoped application.
@@ -2125,7 +2256,80 @@ EXAMPLES
       dev
 ```
 
-_See code: [src/commands/flow/copy.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/copy.ts)_
+_See code: [src/commands/flow/copy.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/copy.ts)_
+
+## `nex flow definition`
+
+Retrieve the read-only design-time definition of a flow, subflow, or action.
+
+```
+USAGE
+  $ nex flow definition -i <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-t flow|subflow|action] [--scope
+    <value>]
+
+FLAGS
+  -a, --auth=<value>    Auth alias to use.
+  -i, --sys-id=<value>  (required) sys_id of the flow, subflow, or action to retrieve
+  -j, --json            Output the complete typed result as JSON
+  -t, --type=<option>   [default: flow] Artifact type to retrieve. Must match what the sys_id actually is.
+                        <options: flow|subflow|action>
+      --scope=<value>   Scope sys_id or name for the transaction scope parameter. Optional — ServiceNow resolves the
+                        artifact's own scope when omitted.
+
+GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
+  --log-dir=<value>     Directory to write log files to. Implies --log-file.
+  --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
+                        (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
+                        stderr only.
+  --log-level=<option>  [default: info] Specify level for logging.
+                        <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
+
+DESCRIPTION
+  Retrieve the read-only design-time definition of a flow, subflow, or action.
+
+  Returns what the artifact IS, not what a run of it did: triggers, actions, nested subflows, flow logic, inputs and
+  outputs as Workflow Studio stores them. Nothing is executed, published or modified, and no flow context is created or
+  required.
+
+  This is the design-time counterpart to `flow details`, which describes one past execution and needs a context sys_id.
+
+  The type is never inferred from the sys_id: --type selects the artifact that is asked for, and a sys_id of a different
+  type fails with a type_mismatch rather than being relabelled.
+
+  With --json, stdout carries exactly one JSON document — the complete typed result including the untouched ServiceNow
+  payload — so it can be piped or redirected. Without it, a short summary is printed; definition bodies, step scripts
+  and input values are never printed or logged.
+
+EXAMPLES
+  Summarise a flow definition
+
+    $ nex flow definition --sys-id 887dda5583237210fdb8f7b6feaad32c --auth dev
+
+  Retrieve a subflow definition
+
+    $ nex flow definition -i 887dda5583237210fdb8f7b6feaad32c --type subflow --auth dev
+
+  Retrieve a custom action definition with its ordered steps
+
+    $ nex flow definition -i 887dda5583237210fdb8f7b6feaad32c --type action --auth dev
+
+  Redirect the full JSON definition to a file
+
+    $ nex flow definition -i 887dda5583237210fdb8f7b6feaad32c --json --auth dev > flow.json
+
+  Pipe the JSON definition into another tool
+
+    $ nex flow definition -i 887dda5583237210fdb8f7b6feaad32c --type action --json --auth dev | jq .summary.steps
+```
+
+_See code: [src/commands/flow/definition.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/definition.ts)_
 
 ## `nex flow details`
 
@@ -2133,8 +2337,8 @@ Get rich execution details for a flow context.
 
 ```
 USAGE
-  $ nex flow details -c <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--scope <value>] [-d]
+  $ nex flow details -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>] [-d]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2146,12 +2350,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Get rich execution details for a flow context.
@@ -2182,7 +2390,7 @@ EXAMPLES
     $ nex flow details -c d4e5f6789012345678abcdef01234567 --json --auth dev
 ```
 
-_See code: [src/commands/flow/details.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/details.ts)_
+_See code: [src/commands/flow/details.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/details.ts)_
 
 ## `nex flow error`
 
@@ -2190,8 +2398,8 @@ Retrieve error details from a failed flow execution.
 
 ```
 USAGE
-  $ nex flow error -c <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--scope <value>]
+  $ nex flow error -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2202,12 +2410,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Retrieve error details from a failed flow execution.
@@ -2220,7 +2432,7 @@ EXAMPLES
     $ nex flow error --context-id abc123def456 --auth dev
 ```
 
-_See code: [src/commands/flow/error.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/error.ts)_
+_See code: [src/commands/flow/error.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/error.ts)_
 
 ## `nex flow logs`
 
@@ -2228,8 +2440,8 @@ Retrieve flow execution log entries for a given context.
 
 ```
 USAGE
-  $ nex flow logs -c <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-l <value>] [-o asc|desc]
+  $ nex flow logs -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-l <value>] [-o asc|desc]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2242,12 +2454,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Retrieve flow execution log entries for a given context.
@@ -2274,7 +2490,7 @@ EXAMPLES
     $ nex flow logs -c d4e5f6789012345678abcdef01234567 --json --auth dev
 ```
 
-_See code: [src/commands/flow/logs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/logs.ts)_
+_See code: [src/commands/flow/logs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/logs.ts)_
 
 ## `nex flow message`
 
@@ -2282,8 +2498,9 @@ Send a message to a paused flow execution.
 
 ```
 USAGE
-  $ nex flow message -c <value> -m <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [-p <value>] [--scope <value>]
+  $ nex flow message -c <value> -m <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-p <value>] [--scope
+    <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2296,12 +2513,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Send a message to a paused flow execution.
@@ -2319,7 +2540,7 @@ EXAMPLES
     $ nex flow message --context-id abc123def456 --message "data_ready" --payload '{"status":"ok"}' --auth dev
 ```
 
-_See code: [src/commands/flow/message.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/message.ts)_
+_See code: [src/commands/flow/message.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/message.ts)_
 
 ## `nex flow outputs`
 
@@ -2327,8 +2548,8 @@ Retrieve outputs from a completed flow execution.
 
 ```
 USAGE
-  $ nex flow outputs -c <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--scope <value>]
+  $ nex flow outputs -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2339,12 +2560,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Retrieve outputs from a completed flow execution.
@@ -2361,7 +2586,7 @@ EXAMPLES
     $ nex flow outputs --context-id abc123def456 --json --auth dev
 ```
 
-_See code: [src/commands/flow/outputs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/outputs.ts)_
+_See code: [src/commands/flow/outputs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/outputs.ts)_
 
 ## `nex flow run`
 
@@ -2369,8 +2594,9 @@ Execute a published Flow Designer flow by scoped name.
 
 ```
 USAGE
-  $ nex flow run -n <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-i <value>] [-m foreground|background] [--scope <value>] [--quick]
+  $ nex flow run -n <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-i <value>] [-m
+    foreground|background] [--scope <value>] [--quick]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -2385,12 +2611,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Execute a published Flow Designer flow by scoped name.
@@ -2422,7 +2652,7 @@ EXAMPLES
     $ nex flow run --name global.my_flow --mode background --auth dev
 ```
 
-_See code: [src/commands/flow/run.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/run.ts)_
+_See code: [src/commands/flow/run.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/run.ts)_
 
 ## `nex flow status`
 
@@ -2430,8 +2660,8 @@ Get the status of a flow execution context.
 
 ```
 USAGE
-  $ nex flow status -c <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--scope <value>]
+  $ nex flow status -c <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2442,12 +2672,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Get the status of a flow execution context.
@@ -2462,7 +2696,7 @@ EXAMPLES
     $ nex flow status --context-id abc123def456 --auth dev
 ```
 
-_See code: [src/commands/flow/status.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/status.ts)_
+_See code: [src/commands/flow/status.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/status.ts)_
 
 ## `nex flow subflow`
 
@@ -2470,8 +2704,9 @@ Execute a published Flow Designer subflow by scoped name.
 
 ```
 USAGE
-  $ nex flow subflow -n <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-i <value>] [-m foreground|background] [--scope <value>] [--quick]
+  $ nex flow subflow -n <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-i <value>] [-m
+    foreground|background] [--scope <value>] [--quick]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -2486,12 +2721,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Execute a published Flow Designer subflow by scoped name.
@@ -2517,7 +2756,7 @@ EXAMPLES
     $ nex flow subflow --name x_myapp.process_record --inputs '{"table":"incident","sys_id":"abc123"}' --auth dev
 ```
 
-_See code: [src/commands/flow/subflow.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/subflow.ts)_
+_See code: [src/commands/flow/subflow.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/subflow.ts)_
 
 ## `nex flow test`
 
@@ -2525,8 +2764,9 @@ Test a Flow Designer flow without requiring it to be published.
 
 ```
 USAGE
-  $ nex flow test -f <value> -o <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--scope <value>] [--synchronous]
+  $ nex flow test -f <value> -o <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--scope <value>]
+    [--synchronous]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2540,12 +2780,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Test a Flow Designer flow without requiring it to be published.
@@ -2575,7 +2819,7 @@ EXAMPLES
     $ nex flow test -f 887dda5583237210fdb8f7b6feaad32c -o '{"current":"abc123"}' --json --auth dev
 ```
 
-_See code: [src/commands/flow/test.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/flow/test.ts)_
+_See code: [src/commands/flow/test.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/flow/test.ts)_
 
 ## `nex health check`
 
@@ -2583,9 +2827,9 @@ Run a consolidated health check on a ServiceNow instance.
 
 ```
 USAGE
-  $ nex health check [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--include-version] [--include-cluster] [--include-stuck-jobs] [--include-semaphores]
-    [--include-operational-counts] [--stuck-job-threshold <value>]
+  $ nex health check [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--include-version] [--include-cluster]
+    [--include-stuck-jobs] [--include-semaphores] [--include-operational-counts] [--stuck-job-threshold <value>]
 
 FLAGS
   -a, --auth=<value>                     Auth alias to use.
@@ -2600,12 +2844,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Run a consolidated health check on a ServiceNow instance.
@@ -2641,7 +2889,7 @@ EXAMPLES
     $ nex health check --json --auth dev
 ```
 
-_See code: [src/commands/health/check.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/health/check.ts)_
+_See code: [src/commands/health/check.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/health/check.ts)_
 
 ## `nex help [COMMAND]`
 
@@ -2661,7 +2909,7 @@ DESCRIPTION
   Display help for nex.
 ```
 
-_See code: [@oclif/plugin-help](https://github.com/oclif/plugin-help/blob/6.2.55/src/commands/help.ts)_
+_See code: [@oclif/plugin-help](https://github.com/oclif/plugin-help/blob/6.2.56/src/commands/help.ts)_
 
 ## `nex log`
 
@@ -2669,8 +2917,9 @@ Tail and monitor ServiceNow system logs in real-time with beautiful formatting.
 
 ```
 USAGE
-  $ nex log [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-o <value>] [-i <value>] [--no-color] [-f <value>...]
+  $ nex log [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-o <value>] [-i <value>] [--no-color] [-f
+    <value>...]
 
 FLAGS
   -a, --auth=<value>       Auth alias to use.
@@ -2685,6 +2934,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -2692,6 +2943,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Tail and monitor ServiceNow system logs in real-time with beautiful formatting.
@@ -2772,7 +3025,7 @@ EXAMPLES
     $ nex log --no-color --auth dev-instance
 ```
 
-_See code: [src/commands/log/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/log/index.ts)_
+_See code: [src/commands/log/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/log/index.ts)_
 
 ## `nex plugins`
 
@@ -3064,14 +3317,47 @@ DESCRIPTION
 
 _See code: [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins/blob/5.4.86/src/commands/plugins/update.ts)_
 
+## `nex policy status`
+
+Show what this invocation is permitted to change on the instance, and why.
+
+```
+USAGE
+  $ nex policy status [--json] [--deny-execute] [--deny-write] [--read-only]
+
+FLAGS
+  --deny-execute  Evaluate as if --deny-execute were passed.
+  --deny-write    Evaluate as if --deny-write were passed.
+  --read-only     Evaluate as if --read-only were passed.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Show what this invocation is permitted to change on the instance, and why.
+
+  Changes are permitted by default. NEX_POLICY_DENY, set in the environment, outranks every command-line flag — that is
+  the only layer an agent driving this CLI cannot reach.
+
+EXAMPLES
+  $ nex policy status
+
+  $ nex policy status --read-only
+
+  NEX_POLICY_DENY=all nex policy status
+```
+
+_See code: [src/commands/policy/status.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/policy/status.ts)_
+
 ## `nex query`
 
 Query any ServiceNow table using the Table API.
 
 ```
 USAGE
-  $ nex query -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-q <value>] [-f <value>] [-d] [-l <value>]
+  $ nex query -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>] [-f <value>] [-d] [-l
+    <value>]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3085,12 +3371,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Query any ServiceNow table using the Table API.
@@ -3120,7 +3410,7 @@ EXAMPLES
     $ nex query --table sys_user --query "active=true" --limit 5 --json --auth dev
 ```
 
-_See code: [src/commands/query/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/query/index.ts)_
+_See code: [src/commands/query/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/query/index.ts)_
 
 ## `nex query app`
 
@@ -3128,8 +3418,8 @@ Search for applications by name across scoped apps and plugins.
 
 ```
 USAGE
-  $ nex query app -s <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-a] [-l <value>]
+  $ nex query app -s <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-a] [-l <value>]
 
 FLAGS
   -a, --active          Only show active applications
@@ -3141,12 +3431,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Search for applications by name across scoped apps and plugins.
@@ -3169,7 +3463,7 @@ EXAMPLES
     $ nex query app --search "HR" --active --auth dev
 ```
 
-_See code: [src/commands/query/app.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/query/app.ts)_
+_See code: [src/commands/query/app.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/query/app.ts)_
 
 ## `nex query columns`
 
@@ -3177,8 +3471,8 @@ List and search columns (fields) on a ServiceNow table.
 
 ```
 USAGE
-  $ nex query columns -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-s <value>]
+  $ nex query columns -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-s <value>]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3189,12 +3483,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   List and search columns (fields) on a ServiceNow table.
@@ -3220,7 +3518,7 @@ EXAMPLES
     $ nex query columns --table incident --json --auth dev
 ```
 
-_See code: [src/commands/query/columns.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/query/columns.ts)_
+_See code: [src/commands/query/columns.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/query/columns.ts)_
 
 ## `nex query syslog`
 
@@ -3228,8 +3526,8 @@ Query ServiceNow system logs (one-shot, non-tailing).
 
 ```
 USAGE
-  $ nex query syslog [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-q <value>] [-l <value>]
+  $ nex query syslog [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-q <value>] [-l <value>]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3240,12 +3538,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Query ServiceNow system logs (one-shot, non-tailing).
@@ -3273,7 +3575,7 @@ EXAMPLES
     $ nex query syslog --query "sourceLIKEincident" --json --auth dev
 ```
 
-_See code: [src/commands/query/syslog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/query/syslog.ts)_
+_See code: [src/commands/query/syslog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/query/syslog.ts)_
 
 ## `nex schema`
 
@@ -3281,9 +3583,9 @@ Discover and inspect a ServiceNow table schema including fields, types, and rela
 
 ```
 USAGE
-  $ nex schema -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--include-choices] [--include-relationships] [--include-ui-policies]
-    [--include-business-rules]
+  $ nex schema -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--include-choices]
+    [--include-relationships] [--include-ui-policies] [--include-business-rules]
 
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -3297,12 +3599,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Discover and inspect a ServiceNow table schema including fields, types, and relationships.
@@ -3328,7 +3634,7 @@ EXAMPLES
     $ nex schema --table incident --include-choices --include-relationships --auth dev
 ```
 
-_See code: [src/commands/schema/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/schema/index.ts)_
+_See code: [src/commands/schema/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/schema/index.ts)_
 
 ## `nex schema field`
 
@@ -3336,8 +3642,8 @@ Get detailed information about a specific field on a ServiceNow table.
 
 ```
 USAGE
-  $ nex schema field -t <value> -f <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace]
+  $ nex schema field -t <value> -f <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3348,12 +3654,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Get detailed information about a specific field on a ServiceNow table.
@@ -3371,7 +3681,7 @@ EXAMPLES
     $ nex schema field --table incident --field priority --json --auth dev
 ```
 
-_See code: [src/commands/schema/field.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/schema/field.ts)_
+_See code: [src/commands/schema/field.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/schema/field.ts)_
 
 ## `nex schema validate-catalog`
 
@@ -3379,8 +3689,8 @@ Validate a ServiceNow catalog item configuration for common issues.
 
 ```
 USAGE
-  $ nex schema validate-catalog -s <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex schema validate-catalog -s <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3390,12 +3700,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Validate a ServiceNow catalog item configuration for common issues.
@@ -3413,7 +3727,7 @@ EXAMPLES
     $ nex schema validate-catalog --sys-id a1b2c3d4e5f6 --json --auth dev
 ```
 
-_See code: [src/commands/schema/validate-catalog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/schema/validate-catalog.ts)_
+_See code: [src/commands/schema/validate-catalog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/schema/validate-catalog.ts)_
 
 ## `nex scope`
 
@@ -3421,8 +3735,8 @@ Get the current application scope or list available applications.
 
 ```
 USAGE
-  $ nex scope [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-l]
+  $ nex scope [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-l]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -3431,6 +3745,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3438,6 +3754,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Get the current application scope or list available applications.
@@ -3456,7 +3774,7 @@ EXAMPLES
     $ nex scope -l --json --auth dev
 ```
 
-_See code: [src/commands/scope/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/scope/index.ts)_
+_See code: [src/commands/scope/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/scope/index.ts)_
 
 ## `nex scope set`
 
@@ -3464,8 +3782,8 @@ Set the current application scope on a ServiceNow instance.
 
 ```
 USAGE
-  $ nex scope set -a <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex scope set -a <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --app-id=<value>  (required) 32-char sys_id of application
@@ -3474,6 +3792,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3481,6 +3801,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Set the current application scope on a ServiceNow instance.
@@ -3495,7 +3817,7 @@ EXAMPLES
     $ nex scope set -a abc123def456ghi789jkl012mno345pq --json --auth dev
 ```
 
-_See code: [src/commands/scope/set.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/scope/set.ts)_
+_See code: [src/commands/scope/set.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/scope/set.ts)_
 
 ## `nex script-sync pull`
 
@@ -3504,8 +3826,8 @@ Pull a script from a ServiceNow instance to a local file.
 ```
 USAGE
   $ nex script-sync pull -n <value> -t sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client
-    [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [-o
-    <value>]
+    [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>] [--log-file] [--log-level
+    debug|warn|error|info|trace] [--read-only] [-o <value>]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3517,6 +3839,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3524,6 +3848,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Pull a script from a ServiceNow instance to a local file.
@@ -3551,7 +3877,7 @@ EXAMPLES
     $ nex script-sync pull -n MyClientScript -t sys_script_client --json --auth dev-instance
 ```
 
-_See code: [src/commands/script-sync/pull.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/script-sync/pull.ts)_
+_See code: [src/commands/script-sync/pull.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/script-sync/pull.ts)_
 
 ## `nex script-sync push`
 
@@ -3560,8 +3886,8 @@ Push a local script file to a ServiceNow instance.
 ```
 USAGE
   $ nex script-sync push -n <value> -t sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client -f
-    <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+    <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>] [--log-file]
+    [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3573,6 +3899,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3580,6 +3908,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Push a local script file to a ServiceNow instance.
@@ -3608,7 +3938,7 @@ EXAMPLES
     $ nex script-sync push -n MyUIScript -t sys_ui_script -f ./scripts/ui-script.js --json --auth dev-instance
 ```
 
-_See code: [src/commands/script-sync/push.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/script-sync/push.ts)_
+_See code: [src/commands/script-sync/push.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/script-sync/push.ts)_
 
 ## `nex script-sync sync`
 
@@ -3616,8 +3946,9 @@ Synchronize all scripts in a directory with a ServiceNow instance.
 
 ```
 USAGE
-  $ nex script-sync sync -d <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-t sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client...]
+  $ nex script-sync sync -d <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-t
+    sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client...]
 
 FLAGS
   -a, --auth=<value>       Auth alias to use.
@@ -3628,6 +3959,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3635,6 +3968,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Synchronize all scripts in a directory with a ServiceNow instance.
@@ -3662,7 +3997,7 @@ EXAMPLES
     $ nex script-sync sync -d ./scripts --json --auth dev-instance
 ```
 
-_See code: [src/commands/script-sync/sync.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/script-sync/sync.ts)_
+_See code: [src/commands/script-sync/sync.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/script-sync/sync.ts)_
 
 ## `nex search`
 
@@ -3670,8 +4005,9 @@ Search platform code across a ServiceNow instance.
 
 ```
 USAGE
-  $ nex search -t <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-l <value>] [-s <value>] [-g <value>] [--table <value>]
+  $ nex search -t <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-l <value>] [-s <value>] [-g <value>]
+    [--table <value>]
 
 FLAGS
   -a, --auth=<value>          Auth alias to use.
@@ -3684,6 +4020,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3691,6 +4029,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Search platform code across a ServiceNow instance.
@@ -3724,7 +4064,7 @@ EXAMPLES
     $ nex search --term "GlideRecord" --limit 10 --json --auth dev-instance
 ```
 
-_See code: [src/commands/search/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/search/index.ts)_
+_See code: [src/commands/search/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/search/index.ts)_
 
 ## `nex search add-table`
 
@@ -3732,8 +4072,8 @@ Add a table to a code search group on a ServiceNow instance.
 
 ```
 USAGE
-  $ nex search add-table -f <value> -g <value> -t <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>]
-    [--log-file] [--log-level debug|warn|error|info|trace]
+  $ nex search add-table -f <value> -g <value> -t <value> [--json] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -3744,6 +4084,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3751,6 +4093,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Add a table to a code search group on a ServiceNow instance.
@@ -3780,7 +4124,7 @@ EXAMPLES
       dev-instance
 ```
 
-_See code: [src/commands/search/add-table.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/search/add-table.ts)_
+_See code: [src/commands/search/add-table.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/search/add-table.ts)_
 
 ## `nex search groups`
 
@@ -3788,8 +4132,8 @@ List all available code search groups on a ServiceNow instance.
 
 ```
 USAGE
-  $ nex search groups [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex search groups [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -3797,6 +4141,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3804,6 +4150,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   List all available code search groups on a ServiceNow instance.
@@ -3825,7 +4173,7 @@ EXAMPLES
     $ nex search groups --json --auth dev-instance
 ```
 
-_See code: [src/commands/search/groups.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/search/groups.ts)_
+_See code: [src/commands/search/groups.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/search/groups.ts)_
 
 ## `nex search tables`
 
@@ -3833,8 +4181,8 @@ List tables configured for a specific code search group.
 
 ```
 USAGE
-  $ nex search tables -g <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex search tables -g <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>          Auth alias to use.
@@ -3843,6 +4191,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3850,6 +4200,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   List tables configured for a specific code search group.
@@ -3872,7 +4224,7 @@ EXAMPLES
     $ nex search tables --search-group "Business Rules" --json --auth dev-instance
 ```
 
-_See code: [src/commands/search/tables.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/search/tables.ts)_
+_See code: [src/commands/search/tables.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/search/tables.ts)_
 
 ## `nex store install`
 
@@ -3880,8 +4232,9 @@ Install an application from the ServiceNow Store.
 
 ```
 USAGE
-  $ nex store install -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--demo-data] [--no-wait] [--poll-interval <value>] [--timeout <value>]
+  $ nex store install -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--demo-data] [--no-wait]
+    [--poll-interval <value>] [--timeout <value>]
 
 FLAGS
   -a, --app-id=<value>         (required) Store application sys_id
@@ -3895,6 +4248,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3902,6 +4257,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Install an application from the ServiceNow Store.
@@ -3920,7 +4277,7 @@ EXAMPLES
     $ nex store install -a abc123 -v 1.0.0 --demo-data --auth dev
 ```
 
-_See code: [src/commands/store/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/store/install.ts)_
+_See code: [src/commands/store/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/store/install.ts)_
 
 ## `nex store search`
 
@@ -3928,8 +4285,9 @@ Search for applications in the ServiceNow Store.
 
 ```
 USAGE
-  $ nex store search [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--limit <value>] [--tab available_for_you|installed|updates] [-t <value>]
+  $ nex store search [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--limit <value>] [--tab
+    available_for_you|installed|updates] [-t <value>]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3941,6 +4299,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3948,6 +4308,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Search for applications in the ServiceNow Store.
@@ -3966,7 +4328,7 @@ EXAMPLES
     $ nex store search --tab updates --limit 10 --auth dev
 ```
 
-_See code: [src/commands/store/search.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/store/search.ts)_
+_See code: [src/commands/store/search.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/store/search.ts)_
 
 ## `nex store update`
 
@@ -3974,8 +4336,9 @@ Update a ServiceNow Store application to a new version.
 
 ```
 USAGE
-  $ nex store update -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--no-wait] [--poll-interval <value>] [--timeout <value>]
+  $ nex store update -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--no-wait]
+    [--poll-interval <value>] [--timeout <value>]
 
 FLAGS
   -a, --app-id=<value>         (required) Store application sys_id
@@ -3988,6 +4351,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -3995,6 +4360,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Update a ServiceNow Store application to a new version.
@@ -4013,7 +4380,7 @@ EXAMPLES
     $ nex store update -a abc123 -v 2.0.0 --timeout 3600000 --auth dev
 ```
 
-_See code: [src/commands/store/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/store/update.ts)_
+_See code: [src/commands/store/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/store/update.ts)_
 
 ## `nex store validate`
 
@@ -4021,8 +4388,8 @@ Validate a batch installation definition file.
 
 ```
 USAGE
-  $ nex store validate -f <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex store validate -f <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -4031,6 +4398,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4038,6 +4407,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Validate a batch installation definition file.
@@ -4048,7 +4419,7 @@ EXAMPLES
     $ nex store validate --file ./batch-definition.json --auth dev
 ```
 
-_See code: [src/commands/store/validate.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/store/validate.ts)_
+_See code: [src/commands/store/validate.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/store/validate.ts)_
 
 ## `nex task approve`
 
@@ -4056,8 +4427,8 @@ Approve a ServiceNow change request.
 
 ```
 USAGE
-  $ nex task approve -n <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-c <value>]
+  $ nex task approve -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-c <value>]
 
 FLAGS
   -a, --auth=<value>      Auth alias to use.
@@ -4067,6 +4438,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4074,6 +4447,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Approve a ServiceNow change request.
@@ -4095,7 +4470,7 @@ EXAMPLES
     $ nex task approve -n CHG0010001 -c "Looks good, approved" --auth dev
 ```
 
-_See code: [src/commands/task/approve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/task/approve.ts)_
+_See code: [src/commands/task/approve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/task/approve.ts)_
 
 ## `nex task assign`
 
@@ -4103,8 +4478,9 @@ Assign a ServiceNow task to a user or group.
 
 ```
 USAGE
-  $ nex task assign -n <value> -u <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [-g <value>] [--table <value>]
+  $ nex task assign -n <value> -u <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-g <value>] [--table
+    <value>]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4116,6 +4492,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4123,6 +4501,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Assign a ServiceNow task to a user or group.
@@ -4151,7 +4531,7 @@ EXAMPLES
     $ nex task assign --number CHG0010001 --table change_request --user admin --auth dev
 ```
 
-_See code: [src/commands/task/assign.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/task/assign.ts)_
+_See code: [src/commands/task/assign.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/task/assign.ts)_
 
 ## `nex task close`
 
@@ -4159,8 +4539,9 @@ Close a ServiceNow incident.
 
 ```
 USAGE
-  $ nex task close --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>]
-    [--log-file] [--log-level debug|warn|error|info|trace] [--close-code <value>]
+  $ nex task close --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
+    [--close-code <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -4171,6 +4552,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4178,6 +4561,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Close a ServiceNow incident.
@@ -4200,7 +4585,7 @@ EXAMPLES
     $ nex task close -n INC0010001 --notes "Closed" --close-code "Solved (Permanently)" --auth dev
 ```
 
-_See code: [src/commands/task/close.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/task/close.ts)_
+_See code: [src/commands/task/close.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/task/close.ts)_
 
 ## `nex task comment`
 
@@ -4208,8 +4593,9 @@ Add a comment or work note to a ServiceNow task.
 
 ```
 USAGE
-  $ nex task comment -c <value> -n <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--table <value>] [--work-note]
+  $ nex task comment -c <value> -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--table <value>]
+    [--work-note]
 
 FLAGS
   -a, --auth=<value>     Auth alias to use.
@@ -4221,6 +4607,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4228,6 +4616,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Add a comment or work note to a ServiceNow task.
@@ -4255,7 +4645,7 @@ EXAMPLES
     $ nex task comment --number CHG0010001 --table change_request --comment "Approved" --auth dev
 ```
 
-_See code: [src/commands/task/comment.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/task/comment.ts)_
+_See code: [src/commands/task/comment.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/task/comment.ts)_
 
 ## `nex task find`
 
@@ -4263,8 +4653,8 @@ Find a ServiceNow task by its number.
 
 ```
 USAGE
-  $ nex task find -n <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--table <value>]
+  $ nex task find -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--table <value>]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4274,6 +4664,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4281,6 +4673,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Find a ServiceNow task by its number.
@@ -4307,7 +4701,7 @@ EXAMPLES
     $ nex task find -n INC0010001 --json --auth dev
 ```
 
-_See code: [src/commands/task/find.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/task/find.ts)_
+_See code: [src/commands/task/find.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/task/find.ts)_
 
 ## `nex task resolve`
 
@@ -4315,8 +4709,9 @@ Resolve a ServiceNow incident with resolution notes.
 
 ```
 USAGE
-  $ nex task resolve --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>]
-    [--log-file] [--log-level debug|warn|error|info|trace] [--close-code <value>]
+  $ nex task resolve --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute]
+    [--deny-write] [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
+    [--close-code <value>]
 
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -4327,6 +4722,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4334,6 +4731,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Resolve a ServiceNow incident with resolution notes.
@@ -4356,7 +4755,7 @@ EXAMPLES
     $ nex task resolve -n INC0010001 --notes "Fixed" --close-code "Solved (Permanently)" --auth dev
 ```
 
-_See code: [src/commands/task/resolve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/task/resolve.ts)_
+_See code: [src/commands/task/resolve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/task/resolve.ts)_
 
 ## `nex update-set`
 
@@ -4364,8 +4763,8 @@ List update sets on a ServiceNow instance.
 
 ```
 USAGE
-  $ nex update-set [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--limit <value>] [-q <value>]
+  $ nex update-set [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--limit <value>] [-q <value>]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -4375,6 +4774,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4382,6 +4783,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   List update sets on a ServiceNow instance.
@@ -4400,7 +4803,7 @@ EXAMPLES
     $ nex update-set --json --auth dev-instance
 ```
 
-_See code: [src/commands/update-set/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/update-set/index.ts)_
+_See code: [src/commands/update-set/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/update-set/index.ts)_
 
 ## `nex update-set clone`
 
@@ -4408,8 +4811,8 @@ Clone an update set and its records.
 
 ```
 USAGE
-  $ nex update-set clone -n <value> -s <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace]
+  $ nex update-set clone -n <value> -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4419,6 +4822,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4426,6 +4831,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Clone an update set and its records.
@@ -4440,7 +4847,7 @@ EXAMPLES
     $ nex update-set clone --source us-001 --name "Cloned Set" --json --auth dev-instance
 ```
 
-_See code: [src/commands/update-set/clone.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/update-set/clone.ts)_
+_See code: [src/commands/update-set/clone.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/update-set/clone.ts)_
 
 ## `nex update-set create`
 
@@ -4448,8 +4855,8 @@ Create a new update set.
 
 ```
 USAGE
-  $ nex update-set create -n <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [--application <value>] [-d <value>]
+  $ nex update-set create -n <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--application <value>] [-d <value>]
 
 FLAGS
   -a, --auth=<value>         Auth alias to use.
@@ -4460,6 +4867,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4467,6 +4876,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Create a new update set.
@@ -4485,7 +4896,7 @@ EXAMPLES
     $ nex update-set create --name "My Feature Set" --application x_my_app --auth dev-instance
 ```
 
-_See code: [src/commands/update-set/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/update-set/create.ts)_
+_See code: [src/commands/update-set/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/update-set/create.ts)_
 
 ## `nex update-set current`
 
@@ -4493,8 +4904,8 @@ Get or set the current update set.
 
 ```
 USAGE
-  $ nex update-set current [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace] [-s <value>]
+  $ nex update-set current [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir <value>]
+    [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-s <value>]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -4503,6 +4914,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4510,6 +4923,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Get or set the current update set.
@@ -4528,7 +4943,7 @@ EXAMPLES
     $ nex update-set current --json --auth dev-instance
 ```
 
-_See code: [src/commands/update-set/current.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/update-set/current.ts)_
+_See code: [src/commands/update-set/current.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/update-set/current.ts)_
 
 ## `nex update-set inspect`
 
@@ -4536,8 +4951,8 @@ Inspect the components of an update set.
 
 ```
 USAGE
-  $ nex update-set inspect -s <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex update-set inspect -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4546,6 +4961,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4553,6 +4970,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Inspect the components of an update set.
@@ -4567,7 +4986,7 @@ EXAMPLES
     $ nex update-set inspect --sys-id us-001 --json --auth dev-instance
 ```
 
-_See code: [src/commands/update-set/inspect.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/update-set/inspect.ts)_
+_See code: [src/commands/update-set/inspect.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/update-set/inspect.ts)_
 
 ## `nex update-set move`
 
@@ -4575,8 +4994,9 @@ Move records between update sets.
 
 ```
 USAGE
-  $ nex update-set move --target <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [--records <value>] [--source <value>]
+  $ nex update-set move --target <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [--records <value>]
+    [--source <value>]
 
 FLAGS
   -a, --auth=<value>     Auth alias to use.
@@ -4587,6 +5007,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4594,6 +5016,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Move records between update sets.
@@ -4612,7 +5036,7 @@ EXAMPLES
     $ nex update-set move --target us-002 --source us-001 --json --auth dev-instance
 ```
 
-_See code: [src/commands/update-set/move.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/update-set/move.ts)_
+_See code: [src/commands/update-set/move.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/update-set/move.ts)_
 
 ## `nex workflow create`
 
@@ -4620,8 +5044,8 @@ Create a complete workflow from a JSON specification file.
 
 ```
 USAGE
-  $ nex workflow create -s <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file] [--log-level
-    debug|warn|error|info|trace]
+  $ nex workflow create -s <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write] [--log-dir
+    <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -4630,6 +5054,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4637,6 +5063,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Create a complete workflow from a JSON specification file.
@@ -4651,7 +5079,7 @@ EXAMPLES
     $ nex workflow create -s ./workflow.json --json --auth dev
 ```
 
-_See code: [src/commands/workflow/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/workflow/create.ts)_
+_See code: [src/commands/workflow/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/workflow/create.ts)_
 
 ## `nex workflow publish`
 
@@ -4659,8 +5087,8 @@ Publish a workflow version.
 
 ```
 USAGE
-  $ nex workflow publish -s <value> -v <value> [--json] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace]
+  $ nex workflow publish -s <value> -v <value> [--json] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -4670,6 +5098,8 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --json                Format output as json.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
@@ -4677,6 +5107,8 @@ GLOBAL FLAGS
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Publish a workflow version.
@@ -4691,7 +5123,7 @@ EXAMPLES
     $ nex workflow publish -v wfv-001 -s act-001 --json --auth dev
 ```
 
-_See code: [src/commands/workflow/publish.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/workflow/publish.ts)_
+_See code: [src/commands/workflow/publish.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/workflow/publish.ts)_
 
 ## `nex xml export`
 
@@ -4699,8 +5131,8 @@ Export a single ServiceNow record as XML.
 
 ```
 USAGE
-  $ nex xml export -t <value> -s <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace] [-o <value>]
+  $ nex xml export -t <value> -s <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only] [-o <value>]
 
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4712,12 +5144,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Export a single ServiceNow record as XML.
@@ -4745,7 +5181,7 @@ EXAMPLES
     $ nex xml export --table sys_script --sys-id abc123 --json --auth dev
 ```
 
-_See code: [src/commands/xml/export.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/xml/export.ts)_
+_See code: [src/commands/xml/export.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/xml/export.ts)_
 
 ## `nex xml import`
 
@@ -4753,8 +5189,8 @@ Import XML records into a ServiceNow instance.
 
 ```
 USAGE
-  $ nex xml import -f <value> -t <value> [-j] [-a <value>] [--cred-store] [--log-dir <value>] [--log-file]
-    [--log-level debug|warn|error|info|trace]
+  $ nex xml import -f <value> -t <value> [-j] [-a <value>] [--cred-store] [--deny-execute] [--deny-write]
+    [--log-dir <value>] [--log-file] [--log-level debug|warn|error|info|trace] [--read-only]
 
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -4765,12 +5201,16 @@ FLAGS
 GLOBAL FLAGS
   --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
                         sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
+  --deny-execute        Refuse background scripts, flow runs and ATF runs for this invocation.
+  --deny-write          Refuse any change to instance data for this invocation.
   --log-dir=<value>     Directory to write log files to. Implies --log-file.
   --log-file            Write logs to a file. Defaults to $XDG_STATE_HOME/now-sdk-ext/logs
                         (~/.local/state/now-sdk-ext/logs). Off by default; without this, nex logs warnings and errors to
                         stderr only.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
+  --read-only           Refuse every change to the instance — equivalent to --deny-write --deny-execute. Reads are
+                        unaffected.
 
 DESCRIPTION
   Import XML records into a ServiceNow instance.
@@ -4793,7 +5233,7 @@ EXAMPLES
     $ nex xml import --file ./records.xml --table incident --json --auth dev
 ```
 
-_See code: [src/commands/xml/import.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.1.0/src/commands/xml/import.ts)_
+_See code: [src/commands/xml/import.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.3.0/src/commands/xml/import.ts)_
 <!-- commandsstop -->
 
 ---