---
title: "oz0 policy duties"
description: "Usage and flags for oz0 policy duties."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/policy/duties"
---
# oz0 policy duties

> Usage and flags for oz0 policy duties.

For: Operators and developers looking up a command.

A duty is a named set of functions: patterns as the tool policy's rules take them (\<tool>.\<function>, or
\<plugin>/\<tool>.\<function> to name the plugin too, with * and ?), or the tool policy's types of function (read, write,
sends-out, destructive, unknown).

A pair names two duties one agent may not hold together, and says what happens when
one does: flag (the default) shows it beside what each agent combines, on the install screen, the plugin's Configure
tab, the agent's page, plugin preview and oz0 catalog, and a call that uses it opens a duty_pair finding; refuse
refuses the install, the uses grant or the tool policy change that would let an agent hold it, and the edge refuses a
call that would complete it, naming the rule.

An agent holds a function when its tools name it, its plugin's grants reach it and the tool policy does not refuse it
(for its plugin, or for this agent by a rule on caller.agent). A delegate's functions are its own: splitting two
duties across a delegation is what a delegation is for, and oz0 replay privilege says when a parent and its delegate
hold both sides together.

The rules are the tenant's own. Adding a duty or a pair, turning a flag into a refusal or widening a paired duty
applies at once; removing a pair, turning a refusal into a flag or narrowing a paired duty takes a reason and, under
four eyes, another admin.

They say which functions one agent may hold together; who may approve an agent's change to
a plugin's protected files is a fixed rule of its own, which no duty rule changes.

## Usage

```bash
oz0 policy duties [command]
```

## Subcommands

- [`explain`](https://docs.oz0.ai/reference/cli/oz0/policy/duties/explain)
- [`list`](https://docs.oz0.ai/reference/cli/oz0/policy/duties/list)
- [`set`](https://docs.oz0.ai/reference/cli/oz0/policy/duties/set)

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.