oz0 policy apply
For: Operators and developers looking up a command.
Read a policy file (as oz0 policy export writes it, or a part of one: a part it leaves out stays as it is; its rules, when it has them, are the whole list in order) and list every change it makes, one by one: each rule added, removed or changed, the order, and each setting, with whether it tightens or loosens the policy and why, loosenings first.
Then it asks before it applies them (--yes when no one is at the terminal; without either it changes nothing). The tightenings are saved at once; the loosenings go through the tenant's governance after them: they take the reason, and where four eyes are on they wait as a change request for another admin. The server checks and decides every change again when it saves. --dry-run lists the changes and saves nothing.
Use - to read the file from standard input.
Usage
oz0 policy apply -f <file> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--dry-run | bool | list the changes and save nothing | |
--file (-f) | string | the policy file (- for standard input) | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it | |
--tenant | string | default | tenant |
--yes | bool | apply without asking |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.