> ## Documentation Index
> Fetch the complete documentation index at: https://onecli.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Effective policy API: See What Agents Can Really Do

> Read the enforced policy for an agent, connection, or app with the OneCLI API. Results combine workspace grants with your organization's rules.

Grants record what you intend an agent to use. Organization rules can narrow that further. The effective policy endpoints show the result: what the gateway actually allows once both apply.

These endpoints are read only. To change the outcome, edit [Grants](https://onecli.sh/docs/api-reference/grants) or your organization rules. For how rules compose with grants, see [Rules](https://onecli.sh/docs/guides/rules.md).

## Related guides

* [Rules: organization policy for agents](https://onecli.sh/docs/guides/rules.md)
* [Agent access: grant credentials to agents](https://onecli.sh/docs/guides/agent-access.md)

## Endpoints

| Endpoint | Method and path | What it does |
| - | - | - |
| [Effective app permissions (workspace)](https://onecli.sh/docs/api-reference/effective-policy/effective-app-permissions-workspace.md) | `GET /policy/effective-app-permissions` | See what the enforced policy decides for every tool of one app in your workspace, for one agent or the all-agents baseline. |
| [Effective credentials of an agent](https://onecli.sh/docs/api-reference/effective-policy/effective-credentials-of-an-agent.md) | `GET /agents/{agentId}/effective-credentials` | List every secret and connection an agent can actually use after organization rules apply, with a status and the deciding rules for each. |
| [Effective agent access to a connection](https://onecli.sh/docs/api-reference/effective-policy/effective-agent-access-to-a-connection.md) | `GET /connections/{connectionId}/effective-agents` | For one connection, see which agents can use it and how far: usable, limited, blocked, or none, with a summary of tool decisions. |

## Next steps

* [API overview](https://onecli.sh/docs/api-reference.md): base URLs, authentication, and pagination
* [Errors](https://onecli.sh/docs/api-reference/errors.md): status codes and the error format
* [Editions](https://onecli.sh/docs/api-reference/editions.md): which endpoints each edition serves


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.