feat: access policies openapi spec

[sk-portkey]

No description provided.

[Copilot]

🟡 Changes recommended

The specification has conflicting error documentation and incorrectly models valid filter and subject inputs.

3 open findings

• Duplicate name incorrectly documented as both 400 and 409 · New
• Boolean filter incorrectly declared as a string · New
• Subject ID schema fails to restrict reserved ANY value · New

What changed in this PR

Adds OpenAPI coverage for managing workspace access policies.

Changes:

• Adds CRUD endpoints, filtering, examples, and response definitions.
• Defines access-policy subjects, targets, and request/response schemas.
• Adds documentation navigation and tagging.

File	Description
openapi.yaml	Defines and documents the Access Policies API.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The schema permits an invalid subject combination and exposes misleading effect-dependent field names.

1 open finding

• Subject ID schema fails to restrict reserved ANY value

2 resolved since last review

• Boolean filter incorrectly declared as a string
• Duplicate name incorrectly documented as both 400 and 409

Previously missed (1)

In code that hasn't changed since last review

Use effect-neutral names for all-user and all-agent fields

openapi.yaml:40996

These names conflict with the deny effect: when effect: deny, allow_all_users: true actually means the policy denies every user (and likewise for agents). Use effect-neutral response fields such as applies_to_all_users and applies_to_all_agents so consumers do not invert the policy's meaning.

🧠 Review effort: Balanced