oz0 plugin declare
For: Operators and developers looking up a command.
Say what a plugin's functions do when their listing declares nothing about it. Such a function asks a person at every call.
Each <function>=<type> writes one rule of the tenant's tool policy naming the function, placed as oz0 plugin policy places a switch, with the action the tenant's policy gives functions of that type: read (it only reads), write (it writes, destroys nothing and stays inside the tenant), sends-out (it sends beyond the tenant and destroys nothing) or destructive (it may delete or overwrite).
Saying a function reads or writes lets its calls run, which loosens the policy: it takes a reason, and waits for another admin where four eyes are on. The rule says the admin's answer, and the reason is kept with it.
Only functions that declare nothing are taken; a function with annotations is switched with oz0 plugin policy. The listing itself still says nothing, so rules by kind and conditions on tool.class read the function as one that declares nothing: ask the plugin's author for the annotations.
Usage
oz0 plugin declare <plugin> <function>=<read|write|sends-out|destructive>... [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it | |
--tenant | string | default | tenant |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.