---
title: "Assign duties to tool calls"
description: "Assign duties to tool calls for tenant admins and governance reviewers."
canonical_url: "https://docs.oz0.ai/govern/tool-policy/duties"
---
# Assign duties to tool calls

> Assign duties to tool calls for tenant admins and governance reviewers.

For: tenant admins and governance reviewers.

## Duties

The tenant's **duty rules** keep functions apart that one agent should not hold together, such as paying and approving payments, or reading records and deleting them. A **duty** is a named set of functions: patterns as the rules take them (`<tool>.<function>`, or `<plugin>/<tool>.<function>` to name the plugin too, with `*` and `?`), or types of function (Read, Write, Sends out, Destructive, Unknown). A **pair** names two duties one agent may not hold together, and what happens when one does:

<table>
<thead>
  <tr>
    <th>
      Action
    </th>
    
    <th>
      What it does
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Flag
      </strong>
      
       (the default)
    </td>
    
    <td>
      The pair shows beside what each agent combines: on the install screen, the plugin's Configure tab, the agent's page, <code>
        oz0 plugin preview
      </code>
      
       and <code>
        oz0 catalog
      </code>
      
      , and in the answer of the grant or the policy change that lets an agent hold it. A call that uses it opens a <code>
        duty_pair
      </code>
      
       finding about the agent.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Refuse
      </strong>
    </td>
    
    <td>
      The install, the <code>
        uses:
      </code>
      
       grant (<code>
        oz0 plugin grant --accept-uses
      </code>
      
      ), the tool-policy change or the plugin configuration that would let an agent hold it is refused, naming the rule and each side's functions. The edge refuses a call that would complete it for that agent, failing the job as a refusal of the policy does (<code>
        ToolPolicyRefused
      </code>
      
      ), and the audit log keeps it.
    </td>
  </tr>
</tbody>
</table>

What an agent holds. An agent holds a function when its `tools:` name it, its plugin's grants reach it, and this policy does not refuse it, for its plugin or for this agent by a [rule on `caller.agent`](https://docs.oz0.ai/govern/tool-policy/conditions#rules-by-caller) that no earlier rule without a condition decides first. A rule whose condition reads the arguments may let some calls through, so it does not take a function away. These are the functions the install screen and the [governance replay](https://docs.oz0.ai/govern/governance-replay)'s open privilege read.

A delegate's functions are its own: splitting two duties across a delegation is what a delegation is for. The privilege replay says when a parent and an agent it may delegate to hold both sides together.

```bash [Terminal]
oz0 policy duties set --duty pay --functions 'bank/bank.transfer,bank/bank.pay_*' --reason "payments are one duty"
oz0 policy duties set --duty approve --functions erp/invoices.approve --reason "approvals are another"
oz0 policy duties set --pair pay,approve --action refuse --reason "no agent both pays and approves"
oz0 policy duties list
oz0 policy duties explain             # which duties and pairs each agent holds, through which functions
oz0 policy duties set --file duties.yaml --reason "..."   # the whole rules, as YAML or JSON
```

On the console they are under **Govern › Policy**, on the Rules tab, under **Duty rules**: the duties, the pairs, and the agents that hold a pair now.

Governed. The rules are a governance setting of their own (`duty_rules`), kept with the tool policy, which keeps them when it is saved. Adding a duty or a pair, turning a flag into a refusal, or widening a duty a pair names applies at once. Removing a pair, turning a refusal into a flag, or narrowing a paired duty (taking a pattern or a type out) loosens: it takes a reason and, while [four eyes](https://docs.oz0.ai/govern/reviewed-changes#four-eyes-for-governance-changes) is on, another admin.

A refusing pair added while an agent already holds it refuses nothing already installed: the edge refuses that agent's calls of either side, call by call, until the rule or the agent's functions change. The rules are never passed by per install: change the rule, or what the agent may call.

Splitting a pair. `oz0 replay privilege` lists, per agent, the pairs it could hold and those whose both sides its calls in the window used, and suggests the narrowest split: rules that refuse the agent, on `caller.agent`, the side it used less. Test them with `oz0 replay privilege test` and add them as shadow rules with `oz0 replay privilege propose`, as the rest of its suggestion.

A duty rule is enforced where this page says, and says nothing about what it means for any audit or framework. The rule that an agent never approves its own change to what judges a plugin is a different thing: it is fixed, and about who approves (see [Protected paths](https://docs.oz0.ai/govern/reviewed-changes/protected-paths#protected-paths)). They share the words flag and refuse, and nothing else.

## Records available at each check

Installation checks the new version's agents alongside currently installed agents. If another plugin's grant covers functions newly added by this version, their duties appear on its Configure tab and are checked at the edge; that combination is not included in the install check.

Before a node has listed the version's tools, installation does not use a reviewed listing's write classification. It conservatively counts those write functions as Sends out.

Under a refusing pair, a job can be offered again until the edge can identify its agent from the start record. The edge never lets its calls through without an agent identity. A dedicated access-review export of each agent's duties is unavailable; use `oz0 policy duties explain` and the Configure tab.


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.