Effective policy API: See What Agents Can Really Do - OneCLI

Grants record what you intend an agent to use. Organization rules can narrow that further. The effective policy endpoints show the result: what the gateway actually allows once both apply. These endpoints are read only. To change the outcome, edit Grants or your organization rules. For how rules compose with grants, see Rules.

Endpoints

Endpoint	Method and path	What it does
Effective app permissions (workspace)	`GET /policy/effective-app-permissions`	See what the enforced policy decides for every tool of one app in your workspace, for one agent or the all-agents baseline.
Effective credentials of an agent	`GET /agents/{agentId}/effective-credentials`	List every secret and connection an agent can actually use after organization rules apply, with a status and the deciding rules for each.
Effective agent access to a connection	`GET /connections/{connectionId}/effective-agents`	For one connection, see which agents can use it and how far: usable, limited, blocked, or none, with a summary of tool decisions.

Next steps

API overview: base URLs, authentication, and pagination
Errors: status codes and the error format
Editions: which endpoints each edition serves