---
title: "Restrict processing and record contests"
description: "Restrict processing and record contests for tenant admins and governance reviewers."
canonical_url: "https://docs.oz0.ai/govern/personal-data/restrictions-and-contests"
---
# Restrict processing and record contests

> Restrict processing and record contests for tenant admins and governance reviewers.

For: tenant admins and governance reviewers.

## Restrict and object

A person may ask that their data be kept but not processed, or object to one purpose:

```bash [Terminal]
oz0 subject restrict alice@example.com --reason "request 2026-114"
oz0 subject object alice@example.com --purpose marketing --reason "request 2026-115"
oz0 subject restrict alice@example.com --lift --reason "request 2026-114 resolved"
```

A **restriction** refuses every new job about the person, whatever starts it: the runtime API, a chat's next turn, a webhook, an event, a routine (scheduled fires too).

The start fails with `FailedPrecondition` (a webhook or an event delivery with `422`) and a message that names no one. If the restrictions cannot be read at that moment, the start fails rather than run.

Their running jobs are cancelled within seconds, and for two minutes afterwards the edge keeps cancelling any job about them that another edge started before it saw the restriction (`subject.restrict.applied` counts them).

A scheduled fire about them is stopped at its first step; if Temporal is unreachable then, it is cancelled on the edge's next pass instead.

Their data is kept and still in their own bundle.

Their jobs cannot be [kept as eval cases](https://docs.oz0.ai/improve/evals/regressions#keep-a-job-as-an-eval-case) (that runs the job again); cases kept earlier are part of the plugin's source and run as before, so remove a case from its eval file if it holds the person's data.

Their jobs are left out of the [whole-tenant export](https://docs.oz0.ai/admin/tenant-export)'s content, which lists each of them as left out and why (its tables keep the records about them), and out of [governance replays](https://docs.oz0.ai/govern/tool-policy).

An **objection** refuses the jobs about the person that name the purpose, and the ones that name no purpose when their agent declares it, since they may be for it; jobs for other purposes run. Their running jobs that named the purpose are cancelled.

Both need a reason and are audited (`subject.restrict`, `subject.object`). Recording one applies at once.

**Lifting** one is a [governance change](https://docs.oz0.ai/govern/reviewed-changes#four-eyes-for-governance-changes) that loosens a control (`subject_restriction`): it takes a reason, and with four eyes on it waits for another admin, never the one who asked. `subject find` shows both, live and lifted. What restriction and objection must cover under the law is a legal question; this is what the platform does.

## Decision records and contests

An agent whose jobs make or prepare decisions about people (scoring an application, sorting a claim) says so in its definition:

```yaml [agents/scorer.yaml]
name: scorer
decides_about_subject: true
```

When such a job about a person ends, the platform writes its **decision record**: the job's input and the steps it used, by digest; the agent's plugin and version and the runtime's; the models each step used and any fallback; the rules it ran under (its authority, the tool policy's version, its autonomy level) and the calls a rule gated; the approvals and how they were decided; how it ended; and who took part, by role.

It holds no content and no member's name, and nothing reads it to decide again.

Digests are keyed for one answer or exported copy when its reader cannot see the underlying content. This applies to a reader without the content permission, such as an administrator without it or a privacy role that holds `subjects.find` alone.

It also applies to a person's copy exported without its content part, and to records of jobs whose content is closed to its exporter, such as a job their walls close. The copy's audit-entry digests of those jobs' calls, answers and files are keyed too.

Steps with the same input still show the same digest within that answer or copy. No digest can be checked against a guess of what a step read, or compared with another answer's.

```bash [Terminal]
oz0 subject decisions alice@example.com
oz0 subject contest job-01J9... --reason "my income was read from the wrong year"
```

`subject decisions` lists a person's records; their bundle holds them. `subject contest` records that the person disputes a decision, in their words (the reason shows only to readers with the content permission), audits it about the job's people, and tells the agent's owner person through the [notifications](https://docs.oz0.ai/admin/notifications) event `decision.contested`, which names the agent, the job and the contest, never the person or the reason.

What happens next is the owner's: the platform decides nothing again.

Records and contests go with the job: an erasure deletes them, and the tenant's retention does too.

What a record must contain for an automated decision, and what a contest must lead to, are legal questions the platform does not answer.


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.