oz0 policy duties set
For: Operators and developers looking up a command.
Change the tenant's duty rules. --file replaces them all with a YAML or JSON file ("-" reads standard input):
duties: - name: pay functions: bank/bank.transfer, bank/bank.pay_* description: moves money out of the tenant's accounts - name: approve functions: erp/invoices.approve pairs: - duties: pay, approve action: refuse
--duty adds a duty or replaces the one of that name; --pair adds a pair or changes its action; --remove-duty removes a duty no pair names, and --remove-pair a pair. Every change takes a reason (--reason, or $OZ0_REASON). A change that loosens the rules waits for another admin while the tenant's four eyes is on.
The answer lists the pairs agents hold under the rules as saved: a refusing pair an agent holds already is refused at the edge, call by call.
Usage
oz0 policy duties set (--file FILE | --duty NAME [--functions ...] [--types ...] | --pair A,B [--action flag|refuse] | --remove-duty NAME | --remove-pair A,B) [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--action | string | with --pair: flag (the default) or refuse | |
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--description | string | with --duty: what the duty is | |
--duty | string | the duty to add or replace, by name | |
--file | string | a YAML or JSON file with the whole rules (- for standard input) | |
--functions | strings | with --duty: function patterns, <tool>.<function> or <plugin>/<tool>.<function> | |
--json | bool | print JSON instead of a table | |
--pair | string | the pair to add or change: two duties, comma-separated | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it | |
--remove-duty | string | the duty to remove (no pair may name it) | |
--remove-pair | string | the pair to remove: two duties, comma-separated | |
--tenant | string | default | tenant |
--types | strings | with --duty: types of function it covers: read, write, sends-out, destructive, unknown |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.