oz0 policy duties
For: Operators and developers looking up a command.
A duty is a named set of functions: patterns as the tool policy's rules take them (<tool>.<function>, or <plugin>/<tool>.<function> to name the plugin too, with * and ?), or the tool policy's types of function (read, write, sends-out, destructive, unknown).
A pair names two duties one agent may not hold together, and says what happens when one does: flag (the default) shows it beside what each agent combines, on the install screen, the plugin's Configure tab, the agent's page, plugin preview and oz0 catalog, and a call that uses it opens a duty_pair finding; refuse refuses the install, the uses grant or the tool policy change that would let an agent hold it, and the edge refuses a call that would complete it, naming the rule.
An agent holds a function when its tools name it, its plugin's grants reach it and the tool policy does not refuse it (for its plugin, or for this agent by a rule on caller.agent). A delegate's functions are its own: splitting two duties across a delegation is what a delegation is for, and oz0 replay privilege says when a parent and its delegate hold both sides together.
The rules are the tenant's own. Adding a duty or a pair, turning a flag into a refusal or widening a paired duty applies at once; removing a pair, turning a refusal into a flag or narrowing a paired duty takes a reason and, under four eyes, another admin.
They say which functions one agent may hold together; who may approve an agent's change to a plugin's protected files is a fixed rule of its own, which no duty rule changes.
Usage
oz0 policy duties [command]
Subcommands
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.