oz0 tenant labels
For: Operators and developers looking up a command.
A job's labels have a trust part, untrusted once it read outside input, and a confidentiality part: a level from this ordered list (lowest first) and compartments. A tool result declares its level in its _meta (oz0/labels); a level the list does not hold withholds the result. An unlabelled result of a tool whose manifest declares a label source (labels.source) gets the default level, never the lowest. Rules read the level as job.labels.level (its index, so >= works) and job.labels.level_name.
--trusted names open-world functions the tenant vouches for: their results count as trusted, so they do not taint a job. Without flags it shows the settings. A change needs --reason (or $OZ0_REASON); emptying the list (--builtin), dropping or moving down a level, lowering the default level or vouching for a function loosens, and waits for another admin where four eyes is on.
Usage
oz0 tenant labels <tenant> [flags]
oz0 tenant labels [command]
Subcommands
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--builtin | bool | go back to the built-in levels (public, internal, confidential, restricted) | |
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--default-level | string | the level of an unlabelled result of a tool that declares a label source | |
--json | bool | print JSON instead of a table | |
--levels | strings | the levels, lowest first, comma-separated (at most 8) | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it | |
--trusted | strings | open-world functions whose results count as trusted, <tool>.<function> with * (empty to clear) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.