---
title: "oz0 node sandbox-optout"
description: "Usage and flags for oz0 node sandbox-optout."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/node/sandbox-optout"
---
# oz0 node sandbox-optout

> Usage and flags for oz0 node sandbox-optout.

For: Operators and developers looking up a command.

Every harness session whose agent can run a shell or write files (Claude Code's Bash, Write or Edit, an ACP agent's execute, or a harness the platform cannot check) runs only on a node with sandbox tier 1, whoever started the job; a job with no such node fails after ten minutes, naming this command, rather than run without a sandbox.

The sandbox is what limits what a model that misbehaves can reach through the shell: files outside the job's folders, the node's network, its secrets.

An admin of the node's tenant may let one named node run such sessions at tier 0, where it can have no sandbox (Windows, macOS before its sandbox, a Kubernetes pod without the tier-1 configuration, Linux without bubblewrap). It takes a reason and is a governance change: with four eyes on, another admin approves it.

While the node holds it, the node is a health finding, and every job that ran such a session there shows tier 0 on its page and in the audit trail. Jobs an outside event started (webhooks, routines, chat messages) never run there: they keep needing a real tier-1 node. There is no tenant-wide opt-out.

--remove ends it at once; it takes a reason too, which the governance record keeps. Each change is audited (tenant.sandbox_optout).

## Usage

```bash
oz0 node sandbox-optout <node> --reason <why> [--remove] [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --decision-ref
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the decision or case the change follows, such as a case number (at most 200 characters)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --reason
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --remove
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      end the node's opt-out: its shell and write sessions go back to tier-1 nodes
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.