oz0 tenant erasure-policy
For: Operators and developers looking up a command.
The erasure policy decides what oz0 subject erase does in the tenant. allowed (the default) erases at once. second-person files the erasure as a change request that another admin approves (oz0 change approve); the admin who asked never approves it. off refuses every erasure, with a message that says since when, and the jobs started while it is off are sealed with the tenant's key only: they keep their data subjects for lookups and exports, but no erasure can reach them by key, even after the policy is turned back on.
A change applies to jobs started afterwards. It is a governance setting: every change takes --reason, and every change but allowed to second-person loosens, so it waits for another admin where the tenant has four eyes on. A legal hold stops erasure whatever the policy. Without a policy it shows the setting.
Usage
oz0 tenant erasure-policy <tenant> [allowed|second-person|off] [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--json | bool | print JSON instead of a table | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.