Using-pepcli.md

@@ -87,6 +87,19 @@ Other general flags exist, but are intended for use by developers of the PEP sys
 
 The `ama` command's various sub-commands can be used to perform administrative tasks. While `ama` is short for "Access Manager Administration", it should be noted that `ama` provides subcommands for both the `Access Administrator` and `Data Administrator` roles. Users must be enrolled for the role appropriate for the subcommand they're invoking.
 
+### `ama cgar`
+
+The `cgar` subcommand is short for "column group access rule". It allows `Access Administrator` to determine the types of access that access groups have to column groups:
+
+```
+pepcli ama cgar create <column group name> <access group name> <mode>
+pepcli ama cgar remove <column group name> <access group name> <mode>
+```
+
+The column group must have been previously created by a `Data Administrator` using the [`pepcli ama columnGroup`](#ama-columngroup) subcommand. The `mode` parameter must be either `read` or `write`, indicating the type of access to grant or revoke.
+
+After using the `cgar` subcommand, the rule immediately takes effect. Users enrolled for the specified access group will immediately be granted (or denied) access to the specified column group.
+
 ### `ama column`
 
 The `column` subcommand allows `Data Administrator` to create and remove columns: