oz0 tenant labels clearance
For: Operators and developers looking up a command.
An agent's clearance is the highest level, and the compartments (* for every one), of the tool results its model may read. A result above it is withheld: the model reads a notice that names the tool, the job's labels do not take the result's, and the call is recorded (run.result.withheld). The tool still ran and the plugin still read the data.
The tenant's clearance for an agent replaces the one its definition declares; without either the agent has no limit. A hand-off target's calls are held to the stricter of its own clearance and that of the agent its job started on. Raising, widening or removing one loosens, and so does setting one for an agent the tenant had none for (it replaces the definition's, which may be lower): it takes a reason, and another admin while four eyes is on.
Usage
oz0 tenant labels clearance [command]
Subcommands
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.