oz0 user grant
For: Operators and developers looking up a command.
Give an account a role in a tenant, replacing the one it had there. Readers look; operators also start and cancel jobs and decide approvals; admins also change the tenant's nodes, plugins, secrets, tokens and budget; owners also decide who is a member.
Auditors read the audit trail, evidence and governance and change nothing; privacy officers find and erase data subjects and place legal holds; agent users use the agents --agents names in the chat drawer and see their own chats and jobs. --role may name several roles, separated by commas; orchestrator-zero roles lists them with their permissions.
--content says whether the account may see what the tenant's jobs read and wrote; without it, operators and above may, agent users may (they reach only their own chats and jobs), and the others may not.
Usage
oz0 user grant NAME [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--agents | strings | the agent grant: agents, <plugin>/* or tag:<tag> it may start (agent users start only these) | |
--content | bool | operators and above, and agent users | whether the account may see what the tenant's jobs read and wrote |
--role | string | reader, operator, admin, owner, auditor, privacy-officer, agent-user or a role set's role; several separated by commas | |
--tenant | string | default | tenant |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.