oz0 tenant role-rules
Usage and flags for oz0 tenant role-rules.
For: Operators and developers looking up a command.
By default a membership never holds auditor together with a role that changes the tenant (an admin-level or owner-level permission that does more than read): the auditor stays independent of what it audits. --auditor-with-changes allows the combination, which loosens a governance setting: it takes --reason and, with four eyes on, waits for another admin. --auditor-with-changes=false goes back. The tenant's owners may.
Usage
oz0 tenant role-rules <tenant> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--auditor-with-changes | bool | let a membership hold auditor together with a role that changes the tenant (a loosening) | |
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--json | bool | print JSON instead of a table | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.