oz0 model rules
For: Operators and developers looking up a command.
Data rules: the regions providers must be in (eu allows eu and eu-north) and whether providers may keep data after a call. The gateway refuses a call that breaks them with 403 oz0_data_rule and records why in the cost log; aliases skip models that break them. Local models on the tenant's own nodes pass every rule.
For a tenant pinned to a region, rules that name no region allow only providers in that region (a provider whose record names no region passes none); name the regions to allow others.
Hosted web tools, which a provider points at addresses nobody can name beforehand (web search, web fetch, URL context), are off until --hosted-web-tools turns them on: the gateway refuses a call that asks for one with 403 oz0_provider_egress, and a level with an egress list keeps them off for its jobs.
Usage
oz0 model rules [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--clear | bool | remove every rule | |
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--hosted-web-tools | bool | let providers run their hosted web tools for this tenant: web search, web fetch, URL context, and hosted tools the gateway does not know | |
--json | bool | print JSON instead of a table | |
--level-rule | stringArray | a rule for the model calls of jobs at a level or above, as LEVEL:region=eu,no-retention,provider=mistral (regions and providers repeat; | also separates them); replaces that level's rule; repeatable | |
--no-level-rule | stringArray | remove a level's rule; repeatable | |
--no-retention | bool | only providers that keep no data after a call | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it | |
--region | strings | regions providers must be in, such as eu; give it empty (--region '') for any region, or, for a tenant pinned to a region, for its region only | |
--tenant | string | default | tenant |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.