Export and apply a tool policy

For: tenant admins and governance reviewers.

The whole policy as a file

oz0 policy export writes the whole policy as YAML, and oz0 policy apply -f <file> reads one back:

oz0 policy export -o policy.yaml
oz0 policy apply -f policy.yaml --dry-run
oz0 policy apply -f policy.yaml --reason "quarterly review"

# A tenant's tool policy (oz0 policy export). ...
format: oz0.policy/v1
tenant: default
defaults:
  read: allow
  destructive: ask
  reaches_outside: allow
  unknown: ask
approval_deadline: 8h
taint_default: "on"
origin_default: "on"
rules:
  - id: rule-3f9c0a2b81d4
    match: jev_support.refund
    action: ask
    deciders:
      - team:payments
    not_starter: true
    reason: refunds need a person
  - match: payments.*
    action: refuse
    origins:
      role:payee: record

A file is partial: a part it leaves out stays as it is. Its rules, when it has them, are the whole list in order: a rule with an id is that rule, and one without is new.

apply lists every change first, one by one (each rule added, removed or changed, the order, each setting), with whether it tightens or loosens the policy and why, loosenings first, and asks before it applies them; with no one at the terminal it changes nothing without --yes.

It saves the tightenings at once, then the rest through the tenant's governance: with four eyes on, the loosenings wait for another admin as a change request.

A plugin's own switches go in its configuration file (oz0 plugin config export|apply), whose tools: take the same words: allow, ask and refuse; applied, that file is a plugin configuration change, whose loosenings always wait for another admin (two paths).

The two files stay apart: this one is the tenant's whole policy, that one one plugin's settings and switches, which become rules of this policy when applied. oz0 policy apply -f given a plugin's configuration file says so and points to oz0 plugin config apply.

The older commands

oz0 tenant tool-policy set and show keep working as they did, with every flag: --rule '<tool>.<function>=<action> if ... when ...' replaces the rules unless --keep-rules adds to them, and the policy's defaults are --read-only, --destructive, --open-world and --undeclared (Read, Destructive, Reaches outside and Unknown). The settings of the policy that are no rule (the defaults, the approval deadline and ladder, the taint-default and origin-default rules, --recheck-after, --label-egress) are set there.

Each rule has an ID (rule-...), given when it is first saved and kept as long as the rule is: oz0 policy show and oz0 tenant tool-policy show --json list it with the rule's mode, its end, its reason and who proposed it and who let it act. A rule saved before rules had IDs shows one derived from its place until the policy is saved again.