oz0 replay privilege
For: Operators and developers looking up a command.
A privilege replay reads the window's finished jobs as a replay does and, per agent, sets the functions it could call (the tools it lists, through the grants between plugins and the tool policy) against those it called.
The unused ones, weighted by action class (destructive and egress weigh 4, a host write 3, a write 2, a read 1; a function a person must approve weighs half), are its open privilege: the score is their weight over the weight of everything it could call, from 0 (it used all it may) to 1 (it used none of it). The score shows on the agent's scorecard.
For each agent with enough jobs (--min-jobs, 5 by default) the report suggests a tighter candidate: rules that refuse each unused function to that agent alone, with the preset origin privilege. It is a suggestion and is never applied by itself: oz0 replay privilege test ID replays it over the same window, and oz0 replay privilege propose ID adds it to the tenant's tool policy as shadow rules, which decide nothing until a person promotes them.
--preset with --preset-rules (or --policy, --promote) scores under a proposed level change instead of the policy now.
Usage
oz0 replay privilege [--agent A] [--since 7d] [--preset NAME --preset-rules FILE] [flags]
oz0 replay privilege [command]
Subcommands
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--agent | string | only this agent's jobs | |
--json | bool | print JSON instead of a table | |
--max-jobs | int32 | 2000, at most 10000 | at most this many jobs, newest first |
--min-jobs | int32 | 5 | the jobs an agent needs in the window before a tighter candidate is suggested for it |
--plugin | string | only the jobs of this plugin's agents | |
--policy | string | decide under this tool-policy document (JSON) instead of the policy now | |
--poll | duration | 2s | with --wait, how often to look |
--preset | string | decide with this preset added: a shipped one, or the name of the level change --preset-rules proposes | |
--preset-rules | string | a JSON list of tool rules: a proposed level change | |
--promote | strings | decide with these shadow rules acting | |
--since | string | 7d | how far back to read: 7d, 36h, 90m |
--tenant | string | default | tenant |
--wait | bool | wait for the report and print it |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.