Add API support to return effective (resolved) policy after imports resolution

[hu-ahmed]

Today, Policy APIs return configured policy state (local entries + imports config), but not the final resolved policy view after imports are applied.

This issue proposes a follow-up API capability to retrieve the effective/resolved policy.

Current behavior

GET /api/2/policies/{policyId} returns stored policy config.
GET /api/2/policies/{policyId}/entries returns local entries only.
Imports config is visible, but effective merged entries are not directly visible.
Problem

• Difficult to debug and validate authorization behavior.
• Hard to explain effective access when imports and additions are involved.
• Operational/support troubleshooting requires internal knowledge.

Proposal
Add a read API/view that returns the effective resolved policy after:

• import resolution (implicit / explicit / never)
• entriesAdditions merge logic
• allowed additions constraints

Possible shape (one option):

GET /api/2/policies/{policyId}?view=resolved
Alternative:

GET /api/2/policies/{policyId}/resolved
Expected output (high level)

• Fully resolved entries used for enforcement.
• Optional metadata per entry (e.g. local vs imported origin: policyId + entry label).
• Clear indication of what was ignored due to import rules (if feasible).

[thomas-fries-keen]

@hu-ahmed , I like that idea! Was recently thinking about this, because I was wondering how to display permissions to a thing on a user interface.

[thomas-fries-keen]

I would tend to ?view=resolved variant because that would better match to how you control the things API (e.g. channel=live)

[thjaeckle]

I also think a query parameter would be a good choice, e.g. ?view=resolved or ?view=effective.

As the payload is in the same format than the "normal" GET request.

Would we however then leave the imports in the response as well? I guess so ..
So the only "difference" would be in entries then - where we would see a "merged" view of

• all imported policy entries
• and the own policy entries