---
title: "oz0 user grant"
description: "Give an account a role in a tenant, replacing the one it had there."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/user/grant"
---
# oz0 user grant

> Give an account a role in a tenant, replacing the one it had there.

For: Operators and developers looking up a command.

Give an account a role in a tenant, replacing the one it had there. Readers look; operators also start and cancel jobs and decide approvals; admins also change the tenant's nodes, plugins, secrets, tokens and budget; owners also decide who is a member.

Auditors read the audit trail, evidence and governance and change nothing; privacy officers find and erase data subjects and place legal holds; agent users use the agents --agents names in the chat drawer and see their own chats and jobs. --role may name several roles, separated by commas; `orchestrator-zero roles` lists them with their permissions.

--content says whether the account may see what the tenant's jobs read and wrote; without it, operators and above may, agent users may (they reach only their own chats and jobs), and the others may not.

## Usage

```bash
oz0 user grant NAME [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --agents
      </code>
    </td>
    
    <td>
      strings
    </td>
    
    <td>
      
    </td>
    
    <td>
      the agent grant: agents, &lt;plugin>/* or tag:&lt;tag> it may start (agent users start only these)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --content
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      <code>
        operators and above, and agent users
      </code>
    </td>
    
    <td>
      whether the account may see what the tenant's jobs read and wrote
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --role
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      reader, operator, admin, owner, auditor, privacy-officer, agent-user or a role set's role; several separated by commas
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tenant
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        default
      </code>
    </td>
    
    <td>
      tenant
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.