oz0 policy allow
For: Operators and developers looking up a command.
Add one rule to the tenant's tool policy that will let the calls run of the functions <pattern> names: <tool>.<function>, where * matches anything, such as github.merge_pull_request, github.* or *.
The rule goes where a plugin's switch puts its rule: just before the first rule that decides one of its functions for every caller, so it wins over it; rules that decide only some calls (a condition, a caller, another plugin's functions) and narrower rules (github.merge_pull_request under github.*) stay before it and still win for theirs, and floors still raise a decision. A rule with the same pattern that decides for every caller is changed in place.
A rule with --when, --caller or --other-plugins goes before the first rule that decides one of its functions, so it wins for the calls it names. The command says where the rule went; oz0 policy explain <id> says what it decides.
Flags narrow the rule: --when (a CEL condition over each call), --caller, --other-plugins, --type (a kind of function) and --class (an action class, host tools included). --shadow records what the rule would have decided and decides nothing; --expires ends it. An ask rule may say who decides (--deciders, --not-starter), how long its approvals wait (--deadline) and more. --origin makes an origin rule, and --after-... with --then-... a sequence rule: both only raise a decision.
The change takes a reason (--reason or $OZ0_REASON), which the rule keeps as its own; a loosening waits for another admin where four eyes are on.
--agent pins the rule to agents' jobs (a condition on caller.agent beside --when).
With --command, the rule is a command rule instead: it decides the shell commands a harness runs (Claude's Bash, an ACP agent's execute call or terminal, a remote session's bash) by their parse, never their text. Each part of a command (every program after its wrappers: sudo rm -rf / is the part rm -rf /) is decided on its own; a Refuse that matches any part wins, otherwise the first rule that matches decides.
An Allow lets through what its pattern writes and no more (* is one operand, ** the rest, [class] an operand of a class); an Ask or a Refuse catches every part that holds what it writes. A wrapper never matches by itself. The platform's default command rules ask about catastrophic commands; --default <id> writes a rule over one of them, to turn it off (allow) or make it refuse, for --agent, --caller or --target.
A rule stands above a default it carves into and below one it is broader than, and the command says which. One fixed floor asks about every command that cannot be read with certainty; only a Refuse may be written over it (--default cmd.unreadable). A command rule takes --agent, --caller, --target, --shadow, --expires and --id.
Usage
oz0 policy allow <pattern> | --command <pattern> | --default <id> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--after-class | stringArray | a sequence rule's first call: its action class; repeatable | |
--after-compartment | stringArray | a sequence rule's first call: a compartment its result's labels name; repeatable | |
--after-function | string | a sequence rule's first call: its function, a pattern | |
--after-level | string | a sequence rule's first call: a level its result's labels reach, a name of the tenant's list | |
--after-outbound | string | a sequence rule's first call: yes if it can send data out, no if it cannot | |
--after-plugin | string | a sequence rule's first call: its plugin | |
--after-trust | string | a sequence rule's first call: the trust of its result's labels | |
--agent | stringArray | only for calls of this agent's jobs: for functions, the condition caller.agent (beside --when); for a command rule, its agents; repeatable or comma-separated | |
--caller | stringArray | only for calls by plugins: plugin:<name>, publisher:<namespace> or source:<kind> (git, workspace, bundle, oci, hub, mcp, npm, archive); repeatable | |
--class | stringArray | only for calls of functions of this action class: read, write, egress (Sends out) or destructive, host tools included (it writes the condition with each class's host form); repeatable | |
--command | string | a command rule's pattern instead of functions: the program after its wrappers and its flags and operands, * for one operand, ** for the rest, [class] for an operand of a class (home, root, inside-workdir, outside-workdir, unresolvable, device, default-branch, host:<name>), such as 'git push --force * [default-branch]' | |
--confirm | string | for an ask rule: the argument a decider types to confirm each call | |
--deadline | string | for an ask rule: how long its approvals wait, 1m to 720h | |
--deciders | stringArray | for an ask rule: who decides: role:<role>, team:<name>, user:<name> or key:<API key ID>; repeatable or comma-separated | |
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--default | string | a command rule over a default command rule by its ID, such as cmd.download-run: allow turns it off, refuse makes it refuse, for the agents, callers and targets named (oz0 policy show lists the defaults) | |
--dry-run | bool | say where the rule would go, and save nothing | |
--escalation | string | for an ask rule: its escalation ladder: default, off, or steps such as 0.25:deciders,0.5:owner | |
--expires | string | when the rule stops: a time in RFC 3339 or a duration from now, such as 72h | |
--id | string | the new rule's ID (rule-<letters and digits>); the server gives one when empty | |
--json | bool | print JSON instead of a table | |
--not-starter | bool | for an ask rule: never the job's starter (four eyes) | |
--origin | stringArray | an origin rule's floor: <argument>=<origin> or role:<role>=<origin>, origin request, identity, record or any; repeatable | |
--other-plugins | bool | only for calls of another plugin's functions (granted uses) | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it | |
--shadow | bool | decide nothing: record what the rule would have decided (oz0 tenant tool-policy shadow-report) | |
--target | stringArray | for a rule over a default: only what it finds of this class: home, root, outside-workdir, unresolvable, device or default-branch; repeatable | |
--tenant | string | default | tenant |
--then-class | stringArray | a sequence rule's later call, which the rule decides: its action class; repeatable | |
--then-function | string | a sequence rule's later call, which the rule decides: its function, a pattern | |
--then-outbound | string | a sequence rule's later call, which the rule decides: yes if it can send data out, no if it cannot | |
--then-plugin | string | a sequence rule's later call, which the rule decides: its plugin | |
--type | stringArray | only for functions of this kind: read (says readOnlyHint: true; never a remote server's), destructive (says destructiveHint: true), declares-nothing (no annotations at all), not-read or reaches-outside; repeatable | |
--when | string | a CEL condition over each call, such as "args.repo.startsWith('acme/')": the rule decides only the calls it holds for | |
--within | string | a sequence rule's scope: job (default) or tree (the whole job tree) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.