`revoke … (write (<association>))` says "No access rules found" for a rule that exists, exits 0 and changes nothing

[MendixMau]

Environment

• mxcli: built from main @ 95091765 (v0.24.0-165-g95091765), 2026-09-27. First seen on v0.23.0.
• Mendix / mxbuild: 11.12.2, blank app from mx create-project (MPR v2)
• OS: macOS (Darwin 25.6, arm64)

Reproduction

Same setup as #1223, plus:

create association "ModA"."Tag_GuestGroup"
from "ModA"."Tag" to "ModA"."GuestGroup"
type Reference;
grant "ModA"."User" on "ModA"."Tag" (read *, write *);

After this, show access on entity "ModA"."Tag" shows ModA.Tag.Label: ReadWrite and ModA.Tag_GuestGroup: ReadWrite for ModA.User.

Each row below starts from a fresh copy:

Statement	mxcli output	Member rights afterwards
revoke "ModA"."User" on "ModA"."Tag" (write ("Label")); (attribute, control)	Revoked partial access on ModA.Tag from ModA.User	Label: ReadOnly ✓
revoke "ModA"."User" on "ModA"."Tag" (write ("Tag_GuestGroup"));	No access rules found matching ModA.User on ModA.Tag, exit 0	Tag_GuestGroup: ReadWrite (unchanged)
revoke "ModA"."User" on "ModA"."Tag" (write ("ModA"."Tag_GuestGroup"));	Parse error: line 1:51 mismatched input '.' expecting {',', ')'}	not applied

check --references passes the second statement.

Expected

The association's member right drops to ReadOnly, as the attribute's does. Failing that, an error saying association members cannot be revoked individually. Not exit 0.

Actual

A message claiming the rule does not exist, although the attribute revoke on the same rule finds it. Nothing changes. Scripts that rely on the exit code carry on as if it worked.

Workaround: re-grant the whole rule with the member list you want.

Related: #947 (closed; grant replaced the member list instead of merging).

[github-actions]

Issue Triage

Summary:
The revoke … (write (<association>)) command incorrectly reports that no matching access rule exists, exits with status 0, and leaves the association’s member rights unchanged.

Checklist of required bug‑report information

Required info	Present?	Details
mxcli version	✅	built from main @ 95091765 (v0.24.0-165-g95091765)
Mendix version	✅	11.12.2
Scenario (what the user tried to do)	✅	revoke "ModA"."User" on "ModA"."Tag" (write ("Tag_GuestGroup"))
Expected output	✅	Association member right should drop to ReadOnly (or an error stating individual association members cannot be revoked)
Experienced output	✅	Message “No access rules found …”, exit 0, no change
AI bug report (mxcli diag --bundle or session log)	❌	Not included

Missing information
Could you please provide the output of mxcli diag --bundle (or at least the relevant session log) for the commands that demonstrate the issue? This will help us diagnose the problem more accurately. Thank you!

---

Automated triage via OpenRouter — workflow source