oz0 policy edit
Change one rule, by its ID (oz0 policy show lists them): only what a flag names changes, and the rule keeps its place and its ID.
For: Operators and developers looking up a command.
Change one rule, by its ID (oz0 policy show lists them): only what a flag names changes, and the rule keeps its place and its ID. --action is allow, ask or refuse; --match its pattern; --enforce turns a shadow rule on (it then decides), --shadow back to watching; the other flags are oz0 policy allow's, and --no-when, --no-expires, --no-callers and --no-deciders take a setting away.
--class and --agent write the rule's whole condition, so on a rule with a condition give the part to keep with --when too, or --no-when to drop it. A command rule takes --action, --command (its pattern), --default, --agent, --no-agents, --caller, --no-callers, --target, --shadow, --enforce, --expires and --no-expires. To move a rule, remove it and add it again, or export the policy, reorder it and apply it.
The change's reason (--reason or $OZ0_REASON) becomes the rule's reason; a change that loosens the policy waits for another admin where four eyes are on.
Usage
oz0 policy edit <id> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--action | string | allow, ask or refuse | |
--after-class | stringArray | a sequence rule's first call: its action class; repeatable | |
--after-compartment | stringArray | a sequence rule's first call: a compartment its result's labels name; repeatable | |
--after-function | string | a sequence rule's first call: its function, a pattern | |
--after-level | string | a sequence rule's first call: a level its result's labels reach, a name of the tenant's list | |
--after-outbound | string | a sequence rule's first call: yes if it can send data out, no if it cannot | |
--after-plugin | string | a sequence rule's first call: its plugin | |
--after-trust | string | a sequence rule's first call: the trust of its result's labels | |
--agent | stringArray | only for calls of this agent's jobs: for functions, the condition caller.agent (beside --when); for a command rule, its agents; repeatable or comma-separated | |
--caller | stringArray | only for calls by plugins: plugin:<name>, publisher:<namespace> or source:<kind> (git, workspace, bundle, oci, hub, mcp, npm, archive); repeatable | |
--class | stringArray | only for calls of functions of this action class: read, write, egress (Sends out) or destructive, host tools included (it writes the condition with each class's host form); repeatable | |
--command | string | a command rule's pattern instead of functions: the program after its wrappers and its flags and operands, * for one operand, ** for the rest, [class] for an operand of a class (home, root, inside-workdir, outside-workdir, unresolvable, device, default-branch, host:<name>), such as 'git push --force * [default-branch]' | |
--confirm | string | for an ask rule: the argument a decider types to confirm each call | |
--deadline | string | for an ask rule: how long its approvals wait, 1m to 720h | |
--deciders | stringArray | for an ask rule: who decides: role:<role>, team:<name>, user:<name> or key:<API key ID>; repeatable or comma-separated | |
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--default | string | a command rule over a default command rule by its ID, such as cmd.download-run: allow turns it off, refuse makes it refuse, for the agents, callers and targets named (oz0 policy show lists the defaults) | |
--enforce | bool | turn a shadow rule on: it then decides | |
--escalation | string | for an ask rule: its escalation ladder: default, off, or steps such as 0.25:deciders,0.5:owner | |
--expires | string | when the rule stops: a time in RFC 3339 or a duration from now, such as 72h | |
--id | string | the new rule's ID (rule-<letters and digits>); the server gives one when empty | |
--json | bool | print JSON instead of a table | |
--match | string | the rule's pattern, <tool>.<function> with * for anything | |
--no-agents | bool | a command rule: take its agents away | |
--no-callers | bool | take the rule's callers and --other-plugins away | |
--no-deciders | bool | take the rule's deciders and --not-starter away | |
--no-expires | bool | take the rule's end away: it lasts until removed | |
--no-when | bool | take the rule's condition away | |
--not-starter | bool | for an ask rule: never the job's starter (four eyes) | |
--origin | stringArray | an origin rule's floor: <argument>=<origin> or role:<role>=<origin>, origin request, identity, record or any; repeatable | |
--other-plugins | bool | only for calls of another plugin's functions (granted uses) | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it | |
--shadow | bool | decide nothing: record what the rule would have decided (oz0 tenant tool-policy shadow-report) | |
--target | stringArray | for a rule over a default: only what it finds of this class: home, root, outside-workdir, unresolvable, device or default-branch; repeatable | |
--tenant | string | default | tenant |
--then-class | stringArray | a sequence rule's later call, which the rule decides: its action class; repeatable | |
--then-function | string | a sequence rule's later call, which the rule decides: its function, a pattern | |
--then-outbound | string | a sequence rule's later call, which the rule decides: yes if it can send data out, no if it cannot | |
--then-plugin | string | a sequence rule's later call, which the rule decides: its plugin | |
--type | stringArray | only for functions of this kind: read (says readOnlyHint: true; never a remote server's), destructive (says destructiveHint: true), declares-nothing (no annotations at all), not-read or reaches-outside; repeatable | |
--when | string | a CEL condition over each call, such as "args.repo.startsWith('acme/')": the rule decides only the calls it holds for | |
--within | string | a sequence rule's scope: job (default) or tree (the whole job tree) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.