---
title: "oz0 tenant test-approvals"
description: "Test approvals are off by default."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/tenant/test-approvals"
---
# oz0 tenant test-approvals

> Test approvals are off by default.

For: Operators and developers looking up a command.

Test approvals are off by default. While they are on, a small share of the tool approvals a queue is asked (--rate, 0.001 to 0.1, 0.02 by default) draws a test card for the same agent and function, shown a few minutes later in the same queue: the console's and the CLI's list, to the people who may decide it, never to API keys, apps acting for a person, people limited to their own jobs, notifications, webhooks or chat channels.

Its arguments come from a catalogue of values plainly wrong to an attentive reader (an outside drop address, an absurd amount, an outside host, a system path), shaped by the function's input schema; nothing of a real call is copied. A test card is never run: deciding it records the decision and tells the person it was a test. A yes counts as a miss, a no (or an edit that removes every wrong value) as a catch.

Catch rates show per team and per agent through works-council mode.

Tell your people that test approvals exist before you turn them on. Where a works council or employee representatives exist, their agreement may be needed first; record it with --decision-ref. --team limits the queues to named teams' (repeatable); without it every queue, the tenant's included, may get test cards.

Every change takes a reason (--reason or $OZ0_REASON); turning test approvals on, a higher rate or more queues loosens, and waits for a second admin where the tenant has four eyes on. Readers of governance settings may read the setting; admins change it.

## Usage

```bash
oz0 tenant test-approvals <tenant> [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --decision-ref
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the decision or case the change follows, such as a case number (at most 200 characters)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --off
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      turn test approvals off
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --on
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      turn test approvals on (a loosening: a reason, and a second admin under four eyes)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --rate
      </code>
    </td>
    
    <td>
      float
    </td>
    
    <td>
      
    </td>
    
    <td>
      the share of approvals asked that draws a test card, 0.001 to 0.1 (0: the default, 0.02)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --reason
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --team
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      a team whose queue may get test cards; repeatable; --team all for every queue
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.