---
title: "oz0 tenant labels"
description: "A job's labels have a trust part, untrusted once it read outside input, and a confidentiality part: a level from this ordered list (lowest first) and compartments."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/tenant/labels"
---
# oz0 tenant labels

> A job's labels have a trust part, untrusted once it read outside input, and a confidentiality part: a level from this ordered list (lowest first) and compartments.

For: Operators and developers looking up a command.

A job's labels have a trust part, untrusted once it read outside input, and a confidentiality part: a level from this ordered list (lowest first) and compartments. A tool result declares its level in its _meta (oz0/labels); a level the list does not hold withholds the result. An unlabelled result of a tool whose manifest declares a label source (labels.source) gets the default level, never the lowest. Rules read the level as job.labels.level (its index, so >= works) and job.labels.level_name.

--trusted names open-world functions the tenant vouches for: their results count as trusted, so they do not taint a job. Without flags it shows the settings. A change needs --reason (or $OZ0_REASON); emptying the list (--builtin), dropping or moving down a level, lowering the default level or vouching for a function loosens, and waits for another admin where four eyes is on.

## Usage

```bash
oz0 tenant labels <tenant> [flags]
oz0 tenant labels [command]
```

## Subcommands

- [`clearance`](https://docs.oz0.ai/reference/cli/oz0/tenant/labels/clearance)
- [`egress`](https://docs.oz0.ai/reference/cli/oz0/tenant/labels/egress)
- [`people`](https://docs.oz0.ai/reference/cli/oz0/tenant/labels/people)
- [`walls`](https://docs.oz0.ai/reference/cli/oz0/tenant/labels/walls)

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --builtin
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      go back to the built-in levels (public, internal, confidential, restricted)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --decision-ref
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the decision or case the change follows, such as a case number (at most 200 characters)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --default-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the level of an unlabelled result of a tool that declares a label source
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --levels
      </code>
    </td>
    
    <td>
      strings
    </td>
    
    <td>
      
    </td>
    
    <td>
      the levels, lowest first, comma-separated (at most 8)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --reason
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --trusted
      </code>
    </td>
    
    <td>
      strings
    </td>
    
    <td>
      
    </td>
    
    <td>
      open-world functions whose results count as trusted, &lt;tool>.&lt;function> with * (empty to clear)
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.