---
title: "oz0 tenant tool-policy shadow-report"
description: "Usage and flags for oz0 tenant tool-policy shadow-report."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/tenant/tool-policy/shadow-report"
---
# oz0 tenant tool-policy shadow-report

> Usage and flags for oz0 tenant tool-policy shadow-report.

For: Operators and developers looking up a command.

A tool rule in shadow mode (oz0 policy refuse \<pattern> --shadow, or --rule '...  if mode=shadow') decides nothing: each call it would have decided is recorded with what it would have said (Refuse, Ask or Allow), what happened (Allowed, Refused, or Approved or Denied by a person) and the function's action class (Read, Write, Destructive, Sends out, and host tools).

The report sums them per rule, agent and class over the last days, and says how often the rule agreed with what happened. It names agents and classes, never a person.

## Usage

```bash
oz0 tenant tool-policy shadow-report [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --days
      </code>
    </td>
    
    <td>
      int
    </td>
    
    <td>
      <code>
        30
      </code>
    </td>
    
    <td>
      how many days back, 1 to 90
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tenant
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        default
      </code>
    </td>
    
    <td>
      tenant
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.