oz0 policy lint

For: Operators and developers looking up a command.

Check the tenant's tool policy against its catalog and say what looks wrong, each warning with the rule, the reason and the command that fixes it. It warns and never changes the policy; every save prints the same warnings.

• Hidden by an earlier rule: an earlier rule with no condition and no caller decides every call this one would, or, by the catalog, decides each function this one matches first.
• Matches no function: no function in the catalog fits the rule's pattern (and its kinds).
• Reads an argument the function lacks: the condition reads args.<name>, which the function's input schema does not list (a schema that takes other arguments is not judged).
• Leaves out host tools: the condition names tool.class 'destructive' (or read, write) without its host form, so host tools of that class are not decided by it.
• Shadow rule never turned on: a shadow rule that has watched for 30 days or more.
• Unused for 90 days: no call in the last 90 days (or what the audit trail keeps, when less) of a function the rule could decide; approximate, counted from the audit trail by function, and only for rules saved at least 90 days ago.

The platform's own rules and floors are not checked. A pattern that may reach the platform's own functions (oz.*) or a tool no node has listed yet is not judged by the catalog. oz0 doctor runs the same check.

Usage

oz0 policy lint [flags]

Flags

Inherited flags

See all oz0 commands and the global flags.