oz0 policy explain
For: Operators and developers looking up a command.
Say what one rule of the tenant's tool policy does with today's catalog: the functions its pattern and kinds name, which of them it decides (for every caller, or for the calls its condition or callers name), the earlier rules that decide some of them first, the later rules it hides, and what still raises a decision of its functions: the taint-default rule, floors, origin and sequence rules, and a plugin's own requires_approval.
A condition is decided call by call, so the command names it rather than evaluating it.
With --command, it decides a shell command as a harness's shell call would be decided by the tenant's command rules and the platform's defaults, here, with the same reader the nodes run: each part the command runs (every program after its wrappers), the defaults' checks that found something in it, the tenant's rules that match it, what decided it, and the verdict for the whole command (the strictest part, then the floor that asks about what cannot be read).
--agent, --caller and --cwd say whose job runs it and where. Nothing runs, and nothing is saved.
Usage
oz0 policy explain <id> | --command <command> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--agent | string | with --command: the agent whose job runs it, for the rules narrowed to agents | |
--caller | stringArray | with --command: the calling plugin as rules by caller name it: plugin:<name>, publisher:<namespace>, source:<kind> | |
--command | string | a shell command to decide as a harness's shell call would be: its parse, every rule that matched each part, and the one that decided | |
--cwd | string | with --command: the session's working directory, an absolute path (unknown when empty) | |
--json | bool | print JSON instead of a table | |
--tenant | string | default | tenant |
--tool | string | claude-agent-sdk.Bash | with --command: the harness's shell tool, <harness>.<tool> |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.