Tool rules
Choose which tool actions may run, need a decision or must be refused. The example above shows rules you could set, not the defaults.
Read the docsDecide what agents may do before they do it.
Let routine work run. Ask a person about sensitive actions. Refuse actions that should never happen. oz0 checks these rules outside the model.
Example rules you could configure. Choose a proposed action.
oz0 checks your rule
Ask
Service restarts require approval.
The restart waits. An authorized person can approve or deny this specific call in oz0 Console → Approvals.
An agent can propose an action. Your rules decide whether the tool call runs.
What you can do
Approvals
An authorized person reviews the action and arguments in oz0 Console → Approvals, then chooses Approve or Deny. Approval covers that call; other checks still apply. An expired request is denied.
Read the docsStopping work
Stop new work and block further calls for an agent, tool or tenant: an isolated team or customer environment. A receipt records what oz0 could confirm stopped.
Read the docsAudit trail
Keep a record of calls, decisions and admin changes. Export it so someone can check its integrity without access to your cluster.
Read the docsData privacy
Set retention and control access to job content. Supported erasure removes access to a person’s encrypted job data while keeping the audit chain verifiable.
Read the docs