oz0 approval approve
For: Operators and developers looking up a command.
Let a waiting step go ahead.
The decision is bound to the call's arguments: it names the digest of the arguments it decides on (--args-sha256, as approval list --json and approval args show it), and the job refuses it when the approval waits on other arguments. Without the flag, the command reads the approval's digest from approval list first.
With --edit-file, the call is approved with other arguments: the file holds the whole arguments as JSON, such as the ones approval args shows with your changes. The edge checks them against the function's input schema and the tenant's tool policy, and refuses an edit the policy would refuse or that makes the call need another approval; the call is then made with exactly these arguments, and the agent is told which fields you changed.
It takes the content permission, and a tool may refuse edits (approval.edit: false). --confirm types the value of the argument a high-risk call asks to be confirmed (approval.confirm).
With --allow-for, later calls of the same agent and function in this job with exactly the same arguments are approved without asking until the time runs out; a call that differs asks again, and its card names the fields that changed. It is never broader than the job, and never for a call that asks for a typed confirmation.
After approving a call the tenant's tool policy asked about, the command prints the narrowest rule that would have allowed exactly that call: a suggestion to review, which changes nothing by itself.
Usage
oz0 approval approve JOB APPROVAL [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--allow-for | duration | approve the same call again without asking in this job for this long (1m to 168h); a call that differs asks again | |
--args-sha256 | string | the approval's, from approval list | the digest of the arguments you decide on |
--comment | string | why; the agent sees it, and so does the job's history | |
--confirm | string | the value of the argument the approval asks you to type to confirm a high-risk call | |
--edit-file | string | approve with edits: a JSON file (or - for stdin) of the whole arguments to make the call with instead | |
--tenant | string | default | tenant |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.