oz0 tenant tool-policy
For: Operators and developers looking up a command.
A tenant's tool policy decides what happens to calls to its plugins' functions, by what each function's MCP annotations say about it: Read (read-only), Destructive (not read-only, and it says destructiveHint: true), Reaches outside (unless it says openWorldHint: false), or Unknown (no annotations at all, or not read-only and silent on destructiveHint, which MCP reads as destructive).
Each type takes allow, approve (Ask: a person decides each call) or refuse; the strictest that applies wins, and rules that name functions win over the types. A plugin's requires_approval still asks a person. The defaults: Read and Reaches outside functions run, and a person decides each call of a Destructive or an Unknown one.
Nodes apply a new policy to the jobs that start after their next heartbeat; catalog shows what it does to each function. oz0 policy changes one rule at a time, with flags instead of settings inside a rule's text, and exports and applies the whole policy as a file; these commands work as before.
Usage
oz0 tenant tool-policy [command]
Subcommands
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.