Expand description
systemprompt admin access-control — DB → YAML export channel.
Exposes a single subcommand, export-yaml, the explicit one-time
promotion path: it reads role/department rules from
access_control_rules and prints them as a YAML snippet matching
AccessControlConfig. Stdout-only — never writes a file. The operator
pastes the output into the committed YAML baseline and redeploys.
Per-user overrides (rule_type='user') are operational state and are
intentionally excluded from the export.