oz0 plugin policy
For: Operators and developers looking up a command.
Show what the tenant's tool policy does with each of a plugin's functions, grouped by their type: Read (it only reads), Write (it writes and destroys nothing), Sends out (what it sends leaves the tenant; a reviewed plugin may mark a write that stays in the system it manages as Write), Destructive (it may delete or overwrite) and Unknown (it does not say what it does). Each function shows Allow, Ask (a person decides each call) or Refuse, and why.
--set <function or group>=<allow|ask|refuse> switches one function, by <tool>.<function> or its short name, or a whole group (read, write, sends-out, destructive, unknown, or group:<name> where a function has a group's name); approve is the same as ask. To add or change one rule of the tenant's policy, use oz0 policy.
It writes ordinary tool-policy rules naming each function, just before the rule that decided it for every caller, so rules that decide only some calls (a condition, a caller, another plugin's functions) still win for those calls, and floors such as the taint-default rule still raise a decision. A plugin's own requires_approval still asks a person unless the policy refuses. Every change takes a reason; a change that loosens the policy waits for another admin where four eyes are on.
The view after the change says what decides each function now. --caller <plugin> makes the switches a rule for that plugin's agents only (a capability plugin's calls of this plugin's functions), placed before the rule that decides the function for every caller. The server places every switch's rule, so the console, the install screen and this command place them the same way. Judge is not available.
Usage
oz0 plugin policy <plugin> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--caller | string | the switches are for this other plugin's agents only: a rule by caller, such as a capability plugin's calls of a connector's functions | |
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--json | bool | print JSON instead of a table | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it | |
--set | stringArray | <function or group>=<allow|ask|refuse>; repeatable | |
--tenant | string | default | tenant |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.