The WS-API supports a "Change Crypto Domain Configuration" operation that allows changing the access mode of a crypto domain. The zhmcclient also supports that directly as Partition.change_crypto_domain_config().
The zhmccli currently does not support changing the access mode of crypto domains. This issue is to add support for that.