List agent-policies
GET /agent-policies
OPA-compatible policy document controlling AI agent autonomy per organisation. Includes Autonomy Ladder (L0-L3) and freeze-window enforcement (F2.GATEWAY.01+04+05). deny-by-default: no matching active policy = block.
Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Query Parameters
Section titled “Query Parameters ”Strapi REST filter syntax
object
Responses
Section titled “ Responses ”OK
object
object
Determines what scope_value refers to: org = org-level policy, environment = named env (dev/prod/…), action_type = action type pattern.
The scoped value: org documentId, environment name, or action type pattern. Null means applies to all within the org.
L0=observe only (no writes), L1=suggest only (no writes), L2=execute with approval, L3=auto-execute within policy.
Array of time windows where all agent actions are blocked. Format: [{name: string, start: ‘HH:MM’, end: ‘HH:MM’, days: number[], timezone: string}]. days: 0=Sunday…6=Saturday.
Maximum scope of impact a single agent action may have under this policy.
Explicit allowlist of action type strings. Null = all action types are allowed within the autonomy_level.
Explicit blocklist of action type strings. Takes precedence over allowed_action_types.
True when this policy was created by an agent. Used by no-self-policy-mutation guard to reject agent-initiated mutations.
Legacy OPA-compatible policy document. Format: { allow_actions: string[], deny_actions: string[], conditions: { max_instances_per_day?: number, allowed_regions?: string[], … } }
Legacy: Policy specificity scope for OPA matching priority (per-action > per-env > per-provider > global).
Legacy: Glob-style pattern matched against the requested action. ’*’ matches all.
object
object
Missing or invalid authentication
Not authorized (tenant scope or capability)