Works-council mode

For: tenant admins and governance reviewers.

Works-council mode limits access to figures aggregated over people. Each job is still charged to its starter and team, as described in quotas per user and team. The mode starts on for every tenant and stays on until a tenant admin turns it off.

What is hidden, and from whom

A figure about people is a number summed or counted over a person's jobs, spend, approvals, questions or chats. While the mode is on:

A team's size counts its user: members at the time you look, not its API keys or service identities. A team that drops below the threshold is hidden at the next query.

Where a figure needs that many people to have done something, such as the deciders behind the approver statistics, the quality scorecard's decision figures, an evidence pack's decision figures or a rollout's denial signal, only accounts (user:) count: an API key or an operator's certificate is never one of them. Their decisions stay in the figures, so a figure made of decisions with fewer people than the threshold behind it, none included, is hidden.

This applies to:

• oz0 quota usage, which lists your own row, the teams that are large enough and service identities, then a (tenant total) line and a note that the mode is on;
• the console's Cost page (By user and team, with a Tenant total row) and its Teams page, where a hidden team's or person's spending shows as hidden;
• the admin API's GetOwnerUsage, which answers the rows the caller may see, the tenant's total and the mode as it applied (works_council);
• every figure about people added later: budget warnings, scorecards, exports. They all ask the same rule.

What is counted about approvals

Approvals are figures about people too, and stricter than spending: while the mode is on, a group's approval figures need at least the threshold's people among those who decided, not only among its members.

Test approvals themselves are off by default, and turning them on is a governance change with a reason; whether your employee representatives must agree first is for you to find out.

What it does not cover

• Records. The audit trail, a budget request with who asked and who decided, who started a job on its page, and lists of jobs are records, not figures, and are shown as before. The audit trail stays complete in this mode: a refused start's entry keeps the quota that stopped it and its figures as the limit wrote them, a small team's too.
  So audit.read is the control: give it, through the admin role or a custom role, only to the people your agreement with the employee representatives names, such as the tenant's administrators or an auditor, and never as a way for team leads to read their teams' figures.
• Enforcement. Quotas per person and per team are still enforced. A spend refusal names the quota it hit and its figures only to a caller who may read them: a team under the threshold is withheld from its own members too.
• Figures that are not about people, such as cost by agent, model or node and the insights.

The mode does not stop someone from working a person's figure out of two groups built for it, such as a team of five and the same team with one more person, or the tenant's totals minus the teams shown. Changes to teams are in the audit trail as team.member.

Show or change it

oz0 tenant works-council default                       # show it
oz0 tenant works-council default --threshold 10        # teams of ten or more
oz0 tenant works-council default --off --reason "agreed with the employee representatives on 2026-10-01"
oz0 tenant works-council default --on                  # on again

In the console: Govern › Privacy › Works council. The tenant's readers see the setting; only its admins change it.

• The threshold is at least five. Raising it applies at once; lowering it needs a reason.
• Turning it off needs a reason (at most 500 characters). With the mode off, the tenant's readers see what each person's and each team's jobs spent and started, as before this mode existed.

What is audited

oz0 audit --action tenant.works_council.

After an upgrade

Tenants that existed before the upgrade get the mode on, so admins no longer see per-person rows on the Cost page, Budgets' quotas or in quota usage until one of them turns it off with a reason. See Upgrades.