---
title: "oz0 policy explain"
description: "Usage and flags for oz0 policy explain."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/policy/explain"
---
# oz0 policy explain

> Usage and flags for oz0 policy explain.

For: Operators and developers looking up a command.

Say what one rule of the tenant's tool policy does with today's catalog: the functions its pattern and kinds
name, which of them it decides (for every caller, or for the calls its condition or callers name), the earlier rules
that decide some of them first, the later rules it hides, and what still raises a decision of its functions: the
taint-default rule, floors, origin and sequence rules, and a plugin's own requires_approval.

A condition is decided
call by call, so the command names it rather than evaluating it.

With --command, it decides a shell command as a harness's shell call would be decided by the tenant's command rules and
the platform's defaults, here, with the same reader the nodes run: each part the command runs (every program after its
wrappers), the defaults' checks that found something in it, the tenant's rules that match it, what decided it, and the
verdict for the whole command (the strictest part, then the floor that asks about what cannot be read).

--agent, --caller
and --cwd say whose job runs it and where. Nothing runs, and nothing is saved.

## Usage

```bash
oz0 policy explain <id> | --command <command> [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --agent
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --command: the agent whose job runs it, for the rules narrowed to agents
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --caller
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --command: the calling plugin as rules by caller name it: plugin:&lt;name>, publisher:&lt;namespace>, source:&lt;kind>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --command
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a shell command to decide as a harness's shell call would be: its parse, every rule that matched each part, and the one that decided
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --cwd
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --command: the session's working directory, an absolute path (unknown when empty)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tenant
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        default
      </code>
    </td>
    
    <td>
      tenant
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tool
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        claude-agent-sdk.Bash
      </code>
    </td>
    
    <td>
      with --command: the harness's shell tool, &lt;harness>.&lt;tool>
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.