---
title: "oz0 subject"
description: "Usage and flags for oz0 subject."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/subject"
---
# oz0 subject

> Usage and flags for oz0 subject.

For: Operators and developers looking up a command.

A job started with data subjects (`run --data-subject`, data_subject and data_subjects in the runtime API, or a trigger's mapping rule: `subject rule`) has its payloads encrypted with a key of its own, wrapped by a key of each person's.

`subject find` lists what a tenant holds about the person and what keeps each job; `subject erase` destroys the keys, so the payloads in Temporal's history, in External Storage and in backups of either can no longer be read, redacts the audit entries about the person, and deletes the person's jobs from Temporal; jobs of an agent with a keep_for period wait for it (`retention keep-for`).

The tenant's erasure policy (`tenant erasure-policy`) may have a second admin approve an erasure, or refuse it. The subject itself is never stored, only its hash.

## Usage

```bash
oz0 subject [command]
```

## Subcommands

- [`contest`](https://docs.oz0.ai/reference/cli/oz0/subject/contest)
- [`decisions`](https://docs.oz0.ai/reference/cli/oz0/subject/decisions)
- [`erase`](https://docs.oz0.ai/reference/cli/oz0/subject/erase)
- [`erasures`](https://docs.oz0.ai/reference/cli/oz0/subject/erasures)
- [`export`](https://docs.oz0.ai/reference/cli/oz0/subject/export)
- [`find`](https://docs.oz0.ai/reference/cli/oz0/subject/find)
- [`object`](https://docs.oz0.ai/reference/cli/oz0/subject/object)
- [`restrict`](https://docs.oz0.ai/reference/cli/oz0/subject/restrict)
- [`rule`](https://docs.oz0.ai/reference/cli/oz0/subject/rule)

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --tenant
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        default
      </code>
    </td>
    
    <td>
      the tenant
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.