oz0 plugin config apply

Usage and flags for oz0 plugin config apply.

For: Operators and developers looking up a command.

Read a plugin's configuration file (as oz0 plugin config export writes it, or a part of one: what it leaves out stays as it is), show every change it makes, loosenings first, and file it as one change request of kind plugin_config. Nothing changes until a tenant admin approves it with oz0 change approve; --approve approves it at once when you may (a change without a loosening, in a tenant whose review lets the requester approve).

Every value is checked as its own command checks it: a setting against its format and bounds, a mapping rule against every agent it reaches, a switch against the plugin's functions, the egress list against its grammar.

A change of the tool policy, the egress list or a governance setting takes a reason (--reason, default $OZ0_REASON). --link names comparisons the request links, such as runs of the plugin's evals on a changed model (oz0 compare-savings start). --dry-run shows the changes and files nothing. Use - to read the file from standard input.

Usage

oz0 plugin config apply <file> [flags]

Flags

FlagTypeDefaultDescription
--approveboolapprove the change request at once, when you may
--decision-refstringthe decision or case the change follows, such as a case number (at most 200 characters)
--dry-runboolshow what the file changes, and file nothing
--jsonboolprint JSON instead of a table
--linkstringArraya comparison's ID the request links, such as the plugin's evals on a changed model; repeatable
--reasonstringwhy, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it
--tenantstringdefaulttenant

Inherited flags

FlagTypeDefaultDescription
--contextstring$OZ0_CONTEXT or <config dir>/orchestrator-zero/context.jsonCLI context file written by server init
--log-levelstringinfolog level: debug, info, warn or error

See all oz0 commands and the global flags.

On this page
Copyright © 2026