oz0 tenant tool-policy shadow-report
Usage and flags for oz0 tenant tool-policy shadow-report.
For: Operators and developers looking up a command.
A tool rule in shadow mode (oz0 policy refuse <pattern> --shadow, or --rule '... if mode=shadow') decides nothing: each call it would have decided is recorded with what it would have said (Refuse, Ask or Allow), what happened (Allowed, Refused, or Approved or Denied by a person) and the function's action class (Read, Write, Destructive, Sends out, and host tools).
The report sums them per rule, agent and class over the last days, and says how often the rule agreed with what happened. It names agents and classes, never a person.
Usage
oz0 tenant tool-policy shadow-report [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--days | int | 30 | how many days back, 1 to 90 |
--json | bool | print JSON instead of a table | |
--tenant | string | default | tenant |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.