---
title: "oz0 policy allow"
description: "Usage and flags for oz0 policy allow."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/policy/allow"
---
# oz0 policy allow

> Usage and flags for oz0 policy allow.

For: Operators and developers looking up a command.

Add one rule to the tenant's tool policy that will let the calls run of the functions \<pattern> names: \<tool>.\<function>, where * matches anything, such as github.merge_pull_request, github.* or *.

The rule goes where a plugin's switch puts its rule: just before the first rule that decides one of its functions for every caller, so it wins over it; rules that decide only some calls (a condition, a caller, another plugin's functions) and narrower rules (github.merge_pull_request under github.*) stay before it and still win for theirs, and floors still raise a decision. A rule with the same pattern that decides for every caller is changed in place.

A rule with --when, --caller or --other-plugins goes before the first rule that decides one of its functions, so it wins for the calls it names. The command says where the rule went; oz0 policy explain \<id> says what it decides.

Flags narrow the rule: --when (a CEL condition over each call), --caller, --other-plugins, --type (a kind of function) and --class (an action class, host tools included). --shadow records what the rule would have decided and decides nothing; --expires ends it. An ask rule may say who decides (--deciders, --not-starter), how long its approvals wait (--deadline) and more. --origin makes an origin rule, and --after-... with --then-... a sequence rule: both only raise a decision.

The change takes a reason (--reason or $OZ0_REASON), which the rule keeps as its own; a loosening waits for another admin where four eyes are on.

--agent pins the rule to agents' jobs (a condition on caller.agent beside --when).

With --command, the rule is a command rule instead: it decides the shell commands a harness runs (Claude's Bash, an ACP agent's execute call or terminal, a remote session's bash) by their parse, never their text. Each part of a command (every program after its wrappers: sudo rm -rf / is the part rm -rf /) is decided on its own; a Refuse that matches any part wins, otherwise the first rule that matches decides.

An Allow lets through what its pattern writes and no more (* is one operand, ** the rest, [class] an operand of a class); an Ask or a Refuse catches every part that holds what it writes. A wrapper never matches by itself. The platform's default command rules ask about catastrophic commands; --default \<id> writes a rule over one of them, to turn it off (allow) or make it refuse, for --agent, --caller or --target.

A rule stands above a default it carves into and below one it is broader than, and the command says which. One fixed floor asks about every command that cannot be read with certainty; only a Refuse may be written over it (--default cmd.unreadable). A command rule takes --agent, --caller, --target, --shadow, --expires and --id.

## Usage

```bash
oz0 policy allow <pattern> | --command <pattern> | --default <id> [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --after-class
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      a sequence rule's first call: its action class; repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --after-compartment
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      a sequence rule's first call: a compartment its result's labels name; repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --after-function
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a sequence rule's first call: its function, a pattern
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --after-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a sequence rule's first call: a level its result's labels reach, a name of the tenant's list
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --after-outbound
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a sequence rule's first call: yes if it can send data out, no if it cannot
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --after-plugin
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a sequence rule's first call: its plugin
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --after-trust
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a sequence rule's first call: the trust of its result's labels
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --agent
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      only for calls of this agent's jobs: for functions, the condition caller.agent (beside --when); for a command rule, its agents; repeatable or comma-separated
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --caller
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      only for calls by plugins: plugin:&lt;name>, publisher:&lt;namespace> or source:&lt;kind> (git, workspace, bundle, oci, hub, mcp, npm, archive); repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --class
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      only for calls of functions of this action class: read, write, egress (Sends out) or destructive, host tools included (it writes the condition with each class's host form); repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --command
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a command rule's pattern instead of functions: the program after its wrappers and its flags and operands, * for one operand, ** for the rest, [class] for an operand of a class (home, root, inside-workdir, outside-workdir, unresolvable, device, default-branch, host:&lt;name>), such as 'git push --force * [default-branch]'
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --confirm
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      for an ask rule: the argument a decider types to confirm each call
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --deadline
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      for an ask rule: how long its approvals wait, 1m to 720h
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --deciders
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      for an ask rule: who decides: role:&lt;role>, team:&lt;name>, user:&lt;name> or key:&lt;API key ID>; repeatable or comma-separated
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --decision-ref
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the decision or case the change follows, such as a case number (at most 200 characters)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --default
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a command rule over a default command rule by its ID, such as cmd.download-run: allow turns it off, refuse makes it refuse, for the agents, callers and targets named (oz0 policy show lists the defaults)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --dry-run
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      say where the rule would go, and save nothing
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --escalation
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      for an ask rule: its escalation ladder: default, off, or steps such as 0.25:deciders,0.5:owner
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --expires
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      when the rule stops: a time in RFC 3339 or a duration from now, such as 72h
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --id
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the new rule's ID (rule-&lt;letters and digits>); the server gives one when empty
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --not-starter
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      for an ask rule: never the job's starter (four eyes)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --origin
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      an origin rule's floor: &lt;argument>=&lt;origin> or role:&lt;role>=&lt;origin>, origin request, identity, record or any; repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --other-plugins
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      only for calls of another plugin's functions (granted uses)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --reason
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --shadow
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      decide nothing: record what the rule would have decided (oz0 tenant tool-policy shadow-report)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --target
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      for a rule over a default: only what it finds of this class: home, root, outside-workdir, unresolvable, device or default-branch; repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tenant
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        default
      </code>
    </td>
    
    <td>
      tenant
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --then-class
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      a sequence rule's later call, which the rule decides: its action class; repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --then-function
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a sequence rule's later call, which the rule decides: its function, a pattern
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --then-outbound
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a sequence rule's later call, which the rule decides: yes if it can send data out, no if it cannot
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --then-plugin
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a sequence rule's later call, which the rule decides: its plugin
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --type
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      only for functions of this kind: read (says readOnlyHint: true; never a remote server's), destructive (says destructiveHint: true), declares-nothing (no annotations at all), not-read or reaches-outside; repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --when
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a CEL condition over each call, such as "args.repo.startsWith('acme/')": the rule decides only the calls it holds for
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --within
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a sequence rule's scope: job (default) or tree (the whole job tree)
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.