---
title: "oz0 policy"
description: "Usage and flags for oz0 policy."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/policy"
---
# oz0 policy

> Usage and flags for oz0 policy.

For: Operators and developers looking up a command.

The tenant's tool policy decides what happens to each call of a plugin's functions: Allow (the call runs),
Ask (a person decides each call) or Refuse (the call is not made, and the agent is told why). Rules name functions,
\<tool>.\<function> with * for anything, and the first rule that matches a call decides it; a function no rule names
gets the default for its type: Read, Destructive, Reaches outside or Unknown (it does not say what it does).

Floors,
such as the taint-default rule, and a plugin's own requires_approval only ever raise a decision.

allow, ask and refuse add one rule, placed as a plugin's switch places its rule: just before the rule that decided
its functions for every caller, after the rules that decide only some calls (a condition, a caller), which still win
for those calls. remove, edit and explain work on one rule by its ID (oz0 policy show lists them). export writes the
whole policy as a file and apply reads one back, showing every change first.

Nothing replaces rules you did not name.

Every change takes a reason (--reason, or $OZ0_REASON); a change that loosens the policy waits for another admin where
four eyes are on. The old commands, oz0 tenant tool-policy and oz0 plugin policy, work as before.

## Usage

```bash
oz0 policy [command]
```

## Subcommands

- [`allow`](https://docs.oz0.ai/reference/cli/oz0/policy/allow)
- [`apply`](https://docs.oz0.ai/reference/cli/oz0/policy/apply)
- [`ask`](https://docs.oz0.ai/reference/cli/oz0/policy/ask)
- [`duties`](https://docs.oz0.ai/reference/cli/oz0/policy/duties)
- [`edit`](https://docs.oz0.ai/reference/cli/oz0/policy/edit)
- [`explain`](https://docs.oz0.ai/reference/cli/oz0/policy/explain)
- [`export`](https://docs.oz0.ai/reference/cli/oz0/policy/export)
- [`lint`](https://docs.oz0.ai/reference/cli/oz0/policy/lint)
- [`refuse`](https://docs.oz0.ai/reference/cli/oz0/policy/refuse)
- [`remove`](https://docs.oz0.ai/reference/cli/oz0/policy/remove)
- [`show`](https://docs.oz0.ai/reference/cli/oz0/policy/show)

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.