---
title: "oz0 policy duties set"
description: "Change the tenant's duty rules."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/policy/duties/set"
---
# oz0 policy duties set

> Change the tenant's duty rules.

For: Operators and developers looking up a command.

Change the tenant's duty rules. --file replaces them all with a YAML or JSON file ("-" reads standard input):

duties:
- name: pay
functions: <span>

bank/bank.transfer, bank/bank.pay_*

</span>


description: moves money out of the tenant's accounts
- name: approve
functions: <span>

erp/invoices.approve

</span>


pairs:
- duties: <span>

pay, approve

</span>


action: refuse

--duty adds a duty or replaces the one of that name; --pair adds a pair or changes its action; --remove-duty removes a
duty no pair names, and --remove-pair a pair. Every change takes a reason (--reason, or $OZ0_REASON). A change that
loosens the rules waits for another admin while the tenant's four eyes is on.

The answer lists the pairs agents hold
under the rules as saved: a refusing pair an agent holds already is refused at the edge, call by call.

## Usage

```bash
oz0 policy duties set (--file FILE | --duty NAME [--functions ...] [--types ...] | --pair A,B [--action flag|refuse] | --remove-duty NAME | --remove-pair A,B) [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --action
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --pair: flag (the default) or refuse
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --decision-ref
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the decision or case the change follows, such as a case number (at most 200 characters)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --description
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --duty: what the duty is
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --duty
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the duty to add or replace, by name
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --file
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a YAML or JSON file with the whole rules (- for standard input)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --functions
      </code>
    </td>
    
    <td>
      strings
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --duty: function patterns, &lt;tool>.&lt;function> or &lt;plugin>/&lt;tool>.&lt;function>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --pair
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the pair to add or change: two duties, comma-separated
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --reason
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --remove-duty
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the duty to remove (no pair may name it)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --remove-pair
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the pair to remove: two duties, comma-separated
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tenant
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        default
      </code>
    </td>
    
    <td>
      tenant
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --types
      </code>
    </td>
    
    <td>
      strings
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --duty: types of function it covers: read, write, sends-out, destructive, unknown
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.