@uipath/skills 1.195.0

package/skills/uipath-governance/references/aops-policy/aops-policy-deploy-guide.md

@@ -0,0 +1,371 @@
+# Policy Deploy Guide
+
+Assign policies to a user, group, or tenant by writing a JSON assignment file and passing it to `deployment <subject> configure --input`.
+
+> **Non-interactive.** The agent drives the full flow. Build the JSON file from the user's stated intent (or prompt them to choose per product), call `configure --input`, then verify with `deployment <subject> get`. Do NOT launch `configure` without `--input` — that path is removed.
+
+## Prerequisites
+
+- User must be logged in — see [aops-policy-commands.md — Authentication](./aops-policy-commands.md#authentication).
+- You have the target subject identifier (user / group / tenant GUID). If not, use the matching `list` subcommand — see [aops-policy-commands.md — deployment](./aops-policy-commands.md#uip-gov-aops-policy-deployment-usergrouptenant).
+- You have a session directory for scratch files. Reuse `$SESSION_DIR` from the configure-policy-data session if one exists, or create a new one:
+  ```bash
+  SESSION_DIR="./aops-sessions/$(date +%Y%m%d-%H%M%S)-$(uuidgen | cut -c1-8 | tr '[:upper:]' '[:lower:]')"
+  mkdir -p "$SESSION_DIR"
+  ```
+- For every deployment subcommand's flags, see [aops-policy-commands.md — deployment](./aops-policy-commands.md#uip-gov-aops-policy-deployment-usergrouptenant).
+
+---
+
+## Input file shape
+
+| Subject | JSON shape |
+|---------|------------|
+| user   | `[{ "productIdentifier": "<PRODUCT_NAME>", "policyIdentifier": "<POLICY_GUID>\|null" }, ...]` |
+| group  | `[{ "productIdentifier": "<PRODUCT_NAME>", "policyIdentifier": "<POLICY_GUID>\|null" }, ...]` |
+| tenant | `[{ "productIdentifier": "<PRODUCT_NAME>", "licenseTypeIdentifier": "<LICENSE_TYPE_GUID>", "policyIdentifier": "<POLICY_GUID>\|null" }, ...]` |
+
+Semantics:
+
+- `productIdentifier` — product `name` (not label). See [aops-policy-commands.md — product list](./aops-policy-commands.md#uip-gov-aops-policy-product-list).
+- `licenseTypeIdentifier` (tenant only) — license type **`identifier` (GUID)** from `license-type list`, not the `name` and not the label. See [aops-policy-commands.md — license-type list](./aops-policy-commands.md#uip-gov-aops-policy-license-type-list).
+- `policyIdentifier`:
+  - a policy GUID → assign that policy to this product (and license type, for tenants)
+  - `null` → **No Policy** explicitly (overrides any inherited policy)
+  - **Omit the entry entirely** → inherit (user/group inherits from tenant; tenant inherits from global)
+
+---
+
+## Deployment precedence
+
+When the same product has assignments at multiple scopes, the narrowest wins:
+
+> **User > Group > Tenant**
+
+- A **user** assignment (including explicit `null` = No Policy) overrides any group or tenant assignment for that product.
+- A **group** assignment overrides the tenant assignment for that product (for members of that group).
+- A **tenant** assignment is the org-wide default for a `(product, license type)` pair.
+- A product with no assignment at any scope → inherits the global default (no policy enforced).
+
+**Decision hint:** pick the narrowest scope that matches the user's ask.
+
+> **Precedence is NOT Priority.** The User > Group > Tenant chain above is pure scope resolution — AOps walks it and picks the first level that has an assignment for the product. The policy's `--priority` value is a separate concept and plays no role here. Priority only breaks ties **within the group level**, when a single user belongs to multiple groups that each have their own policy for the same product. See [SKILL.md — Priority rules](./aops-policy-overview-guide.md#priority-rules).
+
+| User's ask | Correct scope |
+|-----------|---------------|
+| "Apply only to Alice" / "exception for jdoe" | user |
+| "Apply to the Developers team" / "everyone in group X" | group |
+| "Everyone in the tenant" / "org-wide default" | tenant |
+| "Everyone except Alice" | tenant + user-level `null` override for Alice |
+
+> **Do not deploy at a broader scope than requested.** If the user says "only for Alice", do not touch tenant or group — a tenant change affects every other user who currently inherits from it.
+
+## License-type → product compatibility
+
+Tenant deployments are keyed by `(product, license type)`. Not every license carries every product — deploying a policy to a `(product, license type)` pair whose license does not include that product is a no-op. Common license → product mappings:
+
+| License type | Products included |
+|--------------|-------------------|
+| RPA Developer | Studio, StudioX, Assistant, Robot |
+| Automation Developer | Studio, StudioX, Assistant, Robot |
+| Citizen Developer | StudioX, Assistant, Robot |
+| Attended Robot | Assistant, Robot |
+| Unattended Robot | Robot |
+| Tester | Studio, Robot |
+
+> Always check the live list via `uip gov aops-policy license-type list --output json` — org-specific license types may exist. See [aops-policy-commands.md — license-type list](./aops-policy-commands.md#uip-gov-aops-policy-license-type-list).
+
+If the user asks to deploy (for example) an Assistant policy to the `Unattended Robot` license, push back — Unattended Robot has no Assistant slot, so the assignment will have no effect.
+
+---
+
+## Subject decision matrix
+
+| User intent | Subject | Section |
+|-------------|---------|---------|
+| "Apply to Alice" / a named individual | user | [3.1](#31-deploy-to-a-user) |
+| "Apply to the Developers group" / named team | group | [3.2](#32-deploy-to-a-group) |
+| "Apply to everyone in the tenant" | tenant | [3.3](#33-deploy-to-a-tenant) |
+| "Apply to a license type org-wide" (requires license type) | tenant | [3.3](#33-deploy-to-a-tenant) |
+
+---
+
+## 3.1 Deploy to a user
+
+### Step 1 — Identify the user
+
+Run `uip gov aops-policy deployment user list --output json` (see [commands reference](./aops-policy-commands.md#deployment-usergrouptenant-list)).
+
+Parse `Data.result[]` (output shape in [aops-policy-commands.md — deployment list](./aops-policy-commands.md#deployment-usergrouptenant-list)). Display as a numbered list:
+
+```text
+Governance users:
+  1. alice@example.com    (source: cloud)    <USER_ID>
+  2. bob@example.com      (source: cloud)    <USER_ID>
+```
+
+- If only one user exists, use it automatically and inform the user.
+- If one entry's `name` or `email` matches the current login (from `uip login status`), suggest it as the default.
+- The list contains only users the governance service has already seen — it is not a full IdP roster. If the target user is missing, fall back to the IdP:
+
+  1. Run `uip admin users list --search "<NAME_OR_EMAIL>" --output json` (see [/uipath:uipath-admin — user-management.md](../../../uipath-admin/references/user-management.md)).
+  2. From the matched record, take `id` as `$USER_ID`, `displayName` (or `userName`) as `$USER_DISPLAY_NAME`, and `email` as `$USER_EMAIL`. Set `$USER_SOURCE` from the IdP origin (`cloud`, `local`, `aad`).
+  3. `configure` auto-registers the user via the `AddUser` endpoint on first call — no separate registration step is needed.
+  4. If the IdP search also returns nothing, ask the caller to supply the GUID, display name, and email directly.
+
+Store the chosen user's `identifier` as `$USER_ID`, its `name` as `$USER_DISPLAY_NAME`, its `email` as `$USER_EMAIL`, and its `source` as `$USER_SOURCE`. `$USER_DISPLAY_NAME`, `$USER_EMAIL`, and `$USER_SOURCE` are all passed to `configure` in the next step.
+
+### Step 2 — Pick policies per product (pre-fill defaults; prompt only on ambiguity)
+
+**Skip rule:** if the user's original request already named the product(s) and policy(s) to assign, use those directly — do not re-ask.
+
+1. Run `uip gov aops-policy product list --output json` to enumerate products (show `label` and `name`, no internal flags).
+2. For each product the user wants to assign, run `uip gov aops-policy list --product-name "<PRODUCT_NAME>" --output json` to list candidate policies. Auto-match to the user's stated intent; prompt only if the intent is ambiguous or missing.
+3. Fetch the current assignments to build the diff: `uip gov aops-policy deployment user get "$USER_ID" --output json`. **Do NOT prompt for confirmation here** — confirmation happens at Step 4 only.
+
+### Step 3 — Write the assignment file
+
+```bash
+cat > "$SESSION_DIR/user-policies.json" <<'EOF'
+[
+  { "productIdentifier": "AITrustLayer", "policyIdentifier": "<POLICY_GUID>" },
+  { "productIdentifier": "Development",  "policyIdentifier": null }
+]
+EOF
+```
+
+> Only include products whose assignment should change. Omitted products keep their current assignment (inherit from tenant). Use `null` to explicitly clear an assignment (No Policy).
+
+### Step 4 — Final review before configure (single confirmation gate)
+
+This is the **only** yes/no confirmation in the user-deploy flow (Critical Rule #12). Present the full assignment file plus a diff vs the current state:
+
+```text
+Deploying policies to <USER_DISPLAY_NAME>:
+  AI Trust Layer  →   aitl-test-policy   (<POLICY_ID>)
+  Studio          →   (No Policy)
+Omitted products inherit from the tenant.
+
+Apply these changes to <USER_DISPLAY_NAME>? (yes / no)
+```
+
+Do NOT proceed without an explicit `yes`.
+
+### Step 5 — Save the assignments
+
+> **FULL-REPLACE semantics.** `configure` is not a merge. Any product not listed in `$SESSION_DIR/user-policies.json` is removed from the user's override list, and the user falls back to group/tenant inheritance for that product. To preserve existing overrides, seed the input file from `deployment user get "$USER_ID"` before adding or editing entries.
+
+```bash
+uip gov aops-policy deployment user configure "$USER_ID" \
+  --user "$USER_DISPLAY_NAME" \
+  --email "$USER_EMAIL" \
+  --source "$USER_SOURCE" \
+  --input "$SESSION_DIR/user-policies.json" \
+  --output json
+```
+
+The flag is `--user`, **not** `--user-name`. `--source` defaults to `local`; pass the identity-provider source from the `list` entry (e.g. `cloud`, `aad`) so the stored override stays consistent with the upstream identity record. `--email` is used only when governance auto-registers a brand-new user on this call (`AddUser` path); for already-registered users it is ignored. When omitted, it defaults to `--user`. Pass it explicitly whenever the IdP supplied a distinct email so the audit record carries the right address.
+
+### Step 6 — Verify
+
+```bash
+uip gov aops-policy deployment user get "$USER_ID" --output json
+```
+
+`Data` is an array of `{ productIdentifier, policyIdentifier }`. Show the saved per-product assignments and confirm they match the plan.
+
+---
+
+## 3.2 Deploy to a group
+
+### Step 1 — Identify the group
+
+Run `uip gov aops-policy deployment group list --output json`. Parse `Data.result[]` (output shape in [aops-policy-commands.md — deployment list](./aops-policy-commands.md#deployment-usergrouptenant-list)). Display as a numbered list and let the user pick. Store the chosen group's `identifier` as `$GROUP_ID`, its `name` as `$GROUP_DISPLAY_NAME`, and its `source` as `$GROUP_SOURCE`.
+
+If the group is not yet known to the governance service, fall back to the IdP:
+
+1. Run `uip admin groups list --output json` and filter client-side: `--output-filter "Data[?contains(displayName, '<NAME>')]"`. `uip admin groups list` has **no** `--search` flag (see [/uipath:uipath-admin — group-management.md](../../../uipath-admin/references/group-management.md)).
+2. From the matched record, take `id` as `$GROUP_ID` and `displayName` as `$GROUP_DISPLAY_NAME`. Set `$GROUP_SOURCE` from the IdP origin.
+3. `configure` auto-registers the group via the `AddGroup` endpoint on first call — no separate registration step is needed.
+4. If the IdP lookup also returns nothing, ask the caller to supply the GUID and display name directly.
+
+### Step 2 — Pick policies per product (pre-fill defaults; prompt only on ambiguity)
+
+Same as [3.1 Step 2](#step-2--pick-policies-per-product-pre-fill-defaults-prompt-only-on-ambiguity): enumerate products, list candidate policies per product, auto-match to intent, fetch current assignments via `deployment group get "$GROUP_ID"` for the diff.
+
+### Step 3 — Write the assignment file
+
+```bash
+cat > "$SESSION_DIR/group-policies.json" <<'EOF'
+[
+  { "productIdentifier": "AITrustLayer", "policyIdentifier": "<POLICY_GUID>" },
+  { "productIdentifier": "Development",  "policyIdentifier": null }
+]
+EOF
+```
+
+Same semantics as the user variant — include only products whose assignment should change.
+
+### Step 4 — Final review before configure (single confirmation gate)
+
+```text
+Deploying policies to <GROUP_DISPLAY_NAME>:
+  AI Trust Layer  →   aitl-test-policy   (<POLICY_ID>)
+  Studio          →   (No Policy)
+Omitted products inherit from the tenant.
+
+Apply these changes to <GROUP_DISPLAY_NAME>? (yes / no)
+```
+
+Do NOT proceed without an explicit `yes`.
+
+### Step 5 — Save the assignments
+
+> **FULL-REPLACE semantics.** Any product not listed in `$SESSION_DIR/group-policies.json` is removed from the group's override list; its members then fall back to tenant inheritance (unless a per-user override exists). To preserve existing overrides, seed the input from `deployment group get "$GROUP_ID"` first.
+
+```bash
+uip gov aops-policy deployment group configure "$GROUP_ID" \
+  --group "$GROUP_DISPLAY_NAME" \
+  --source "$GROUP_SOURCE" \
+  --input "$SESSION_DIR/group-policies.json" \
+  --output json
+```
+
+The flag is `--group`, **not** `--group-name`. `--source` defaults to `local`; pass the upstream IdP source (e.g. `cloud`, `aad`) from the `list` entry.
+
+### Step 6 — Verify
+
+```bash
+uip gov aops-policy deployment group get "$GROUP_ID" --output json
+```
+
+`Data` is an array of `{ productIdentifier, policyIdentifier }`. Show the saved per-product assignments and confirm they match the plan.
+
+---
+
+## 3.3 Deploy to a tenant
+
+### Step 1 — Identify the license type
+
+Tenant deployments are keyed by `(product, license type)`. List license types via `uip gov aops-policy license-type list --output json` — see [aops-policy-commands.md — license-type list](./aops-policy-commands.md#uip-gov-aops-policy-license-type-list) for the full output shape and sample rendering.
+
+> **Use the license type's `identifier` (GUID) — not its `name`, not its label — as `licenseTypeIdentifier` in tenant assignment entries.** The `name` is only accepted by `deployed-policy get` / `deployed-policy list` as the positional `<license-type>` argument.
+
+### Step 2 — Identify the tenant
+
+```bash
+uip gov aops-policy deployment tenant list --output json
+```
+
+Optional flags: `--product-name <PRODUCT_NAME>`, `--limit <N>`, `--offset <N>`.
+
+> `tenant list` triggers an upstream OMS sync before returning, so freshly created or recently re-enabled tenants show up here without a separate registration step. The first call after a tenant change may take longer.
+
+Parse `Data.result[]` (output shape in [aops-policy-commands.md — deployment list](./aops-policy-commands.md#deployment-usergrouptenant-list)). Each tenant entry carries `tenantPolicies[]` — the current assignments, each keyed by `(productIdentifier, licenseTypeIdentifier, policyIdentifier)`. Let the user pick, then store the chosen tenant's `identifier` as `$TENANT_ID` and `name` as `$TENANT_NAME`.
+
+### Step 3 — Pick policies per `(product, license type)`
+
+1. For each `(product, license type)` pair the user wants to assign, run `uip gov aops-policy list --product-name "<PRODUCT_NAME>" --output json` and pick a policy (or match the user's intent).
+2. Fetch current assignments: `uip gov aops-policy deployment tenant get "$TENANT_ID" --output json`.
+
+### Step 4 — Write the assignment file
+
+```bash
+cat > "$SESSION_DIR/tenant-policies.json" <<'EOF'
+[
+  { "productIdentifier": "AITrustLayer", "licenseTypeIdentifier": "<NOLICENSE_GUID>",    "policyIdentifier": "<POLICY_GUID>" },
+  { "productIdentifier": "Development",  "licenseTypeIdentifier": "<DEVELOPMENT_GUID>",  "policyIdentifier": null }
+]
+EOF
+```
+
+> `licenseTypeIdentifier` is the GUID from `license-type list` (`Data[].identifier`), NOT the license-type `name`. Resolve each license type's GUID from Step 1 before writing the file.
+
+### Step 5 — Final review before configure (single confirmation gate)
+
+```text
+Deploying policies to <TENANT_NAME>:
+  AI Trust Layer  / NoLicense    →   aitl-default  (<POLICY_ID>)
+  Studio          / Development  →   (No Policy)
+Omitted (product, license type) pairs keep their current assignment.
+
+Apply these changes to <TENANT_NAME>? (yes / no)
+```
+
+Do NOT proceed without an explicit `yes`.
+
+### Step 6 — Save the assignments
+
+> **FULL-REPLACE semantics.** Any `(product, license type)` pair not listed in `$SESSION_DIR/tenant-policies.json` is removed from the tenant and reverts to "no pin". To preserve existing assignments, seed the input file from `deployment tenant get "$TENANT_ID"` before editing.
+
+```bash
+uip gov aops-policy deployment tenant configure "$TENANT_ID" \
+  --tenant-name "$TENANT_NAME" \
+  --input "$SESSION_DIR/tenant-policies.json" \
+  --output json
+```
+
+### Step 7 — Verify
+
+```bash
+uip gov aops-policy deployment tenant get "$TENANT_ID" --output json
+```
+
+`Data` is `{ identifier, name, tenantPolicies: [ { productIdentifier, licenseTypeIdentifier, policyIdentifier } ] }`.
+
+---
+
+## Remove assignments
+
+> **Destructive.** Always show the current assignments (`deployment <subject> get`) and get explicit `yes` confirmation before running `delete` or `remove`.
+
+### Remove all policy assignments for a user or group
+
+Use `delete` to strip every assignment in one call. The subject itself remains in the governance system; only the policy mappings are removed.
+
+```bash
+uip gov aops-policy deployment user  delete "$USER_ID"  --output json
+uip gov aops-policy deployment group delete "$GROUP_ID" --output json
+```
+
+Confirmation prompt (verbatim): `Delete all policy assignments for <SUBJECT_NAME>? This cannot be undone. (yes / no)`
+
+### Remove a tenant's assignment for one product (optionally one license type)
+
+Use `remove` for scoped removal. Prefer `remove` over re-running `configure` with `policyIdentifier: null` when the goal is to drop the mapping entirely (setting `null` keeps an explicit "No Policy" override, which still wins over inherited assignments at a higher scope).
+
+```bash
+uip gov aops-policy deployment tenant remove "$TENANT_ID" \
+  --product-name "$PRODUCT_NAME" \
+  --output json
+```
+
+Add `--license-type <LICENSE_TYPE_NAME>` to remove only one license-type entry for that product. Omit it to remove every license-type entry for the product.
+
+Confirmation prompt (verbatim): `Remove <PRODUCT_LABEL> assignment from <TENANT_NAME>? This cannot be undone. (yes / no)`
+
+---
+
+## Debug
+
+| Error | Cause | Fix |
+|-------|-------|-----|
+| `401 Unauthorized` | User token expired or missing | `uip login` and retry — see [aops-policy-commands.md — Authentication](./aops-policy-commands.md#authentication) |
+| `unknown productIdentifier` | Used the product label instead of its `name` | Re-run `uip gov aops-policy product list --output json` and pass the `name` field |
+| `unknown licenseTypeIdentifier` | Used the license `name` or label instead of its `identifier` (GUID) | Re-run `uip gov aops-policy license-type list --output json` and copy the `identifier` field (GUID) |
+| `unknown policyIdentifier` (GUID) | Stale or wrong policy GUID | Re-run `uip gov aops-policy list --product-name "<PRODUCT_NAME>" --output json` and copy the `identifier` |
+| `missing licenseTypeIdentifier in tenant entries` | Tenant entry omitted `licenseTypeIdentifier` | Add it to every tenant-subject entry (required key) |
+| `configure rejects the JSON` | Any of the above + malformed array | Validate with `jq type` and `jq '.[0] | keys'` before resubmitting |
+| `unknown flag --user-name` / `--group-name` | Flag renamed | Use `--user` (user configure) or `--group` (group configure). Only `tenant configure` uses `--tenant-name`. |
+| Existing assignments disappear after `configure` | Treated `configure` as merge | `configure` is FULL-REPLACE — seed the input file from `deployment <subject> get` before adding/modifying entries |
+| `deployment user list` / `group list` returns no results | Subject not yet seen by the governance service (governance only lists subjects with prior overrides) | Resolve from the IdP via the Step 1 fallback (`uip admin users list --search` for users, `uip admin groups list` for groups). `configure` auto-registers the subject on first call via `AddUser` / `AddGroup` — no separate onboarding step needed. |
+| User cannot provide a tenant identifier | Tenant GUID unknown | Retrieve from Orchestrator or UiPath Cloud portal |
+| `null` assignment still inherited at a higher scope | User assumed `null` removed the mapping | `null` means explicit "No Policy" (overrides inheritance); use `tenant remove` (or omit the entry) to restore inheritance |
+
+---
+
+## Related commands
+
+- [aops-policy-commands.md](./aops-policy-commands.md) — every deployment flag and output shape used above.
+- [aops-policy-manage-guide.md](./aops-policy-manage-guide.md) — create the policy before deploying it.
+- [aops-policy-deployed-guide.md](./aops-policy-deployed-guide.md) — verify assignment took effect, or query effective rules after chain resolution.

package/skills/uipath-governance/references/aops-policy/aops-policy-deployed-guide.md

@@ -0,0 +1,135 @@
+# Policy Deployment Query Guide
+
+Query the **single effective deployed policy** for a `(license type, product, tenant)` tuple, or the **full list of applicable policies** ordered by priority, for the calling user (or a named user via S2S).
+
+> **Terminology — read before using.**
+> - `deployed-policy get` returns the **single effective policy** — the one policy that actually applies after the user → group → tenant inheritance chain has been walked and any 'No Policy' pins have been honored. The default mode resolves for the caller's own identity; the S2S `--user-id` mode resolves for a named user; the S2S `--tenant-only` mode skips user/group overrides and returns only the tenant assignment.
+> - `deployed-policy list` returns **every applicable policy** for the caller, in priority order. Use this to see why a particular policy wins — not just the winner.
+> - "Which policy actually applies?" → `get`. "Which policies are in play, and in what order?" → `list`.
+
+## Prerequisites
+
+1. User must be logged in — see [aops-policy-commands.md — Authentication](./aops-policy-commands.md#authentication).
+2. For `--user-id` or `--tenant-only` modes of `get`: an S2S token is required — see [aops-policy-commands.md — S2S token](./aops-policy-commands.md#s2s-token).
+3. All commands require three positional arguments: `<LICENSE_TYPE> <PRODUCT_NAME> <TENANT_ID>`. For flag/positional details, see [aops-policy-commands.md — deployed-policy get](./aops-policy-commands.md#uip-gov-aops-policy-deployed-policy-get) / [deployed-policy list](./aops-policy-commands.md#uip-gov-aops-policy-deployed-policy-list).
+
+---
+
+## Step 1 — Collect required inputs
+
+If the user has not provided the positional values, ask **one at a time** in this order — resolve each before moving to the next:
+
+1. `License type?` — if unknown, run `uip gov aops-policy license-type list --output json` and let the user pick by `name` (e.g. `Attended`, `Unattended`), not by `identifier` (GUID) or label. `deployed-policy get/list` take the `name` as the `<license-type>` positional argument. Store as `$LICENSE_TYPE`.
+2. `Product name (identifier)?` — run `uip gov aops-policy product list --output json` if unknown.
+3. `Tenant identifier (GUID)?` — if unknown, run `uip gov aops-policy deployment tenant list --output json` and let the user pick from tenants that already have policy assignments. Store as `$TENANT_ID`.
+4. **For specific-user lookup only:** `User identifier (GUID)?` — run `uip gov aops-policy deployment user list --output json` if unknown (output shape in [aops-policy-commands.md — deployment list](./aops-policy-commands.md#deployment-usergrouptenant-list)). Store the matching `identifier` as `$USER_ID`. Then ensure the S2S bearer token is available — set `UIP_S2S_TOKEN` in the caller's environment so the CLI picks it up automatically (see [aops-policy-commands.md — S2S token](./aops-policy-commands.md#s2s-token)).
+
+Proceed to the matching query below.
+
+---
+
+## Get the effective deployed policy (default — caller's own identity)
+
+Returns the single effective policy for the caller for the given `(license type, product, tenant)` — the policy that remains after the user → group → tenant inheritance chain has been walked. Uses the caller's `uip login` token. To look up another user's effective policy, add `--s2s-token --user-id`; to skip user/group overrides and see only the tenant-level assignment, add `--s2s-token --tenant-only`.
+
+```bash
+uip gov aops-policy deployed-policy get \
+  "$LICENSE_TYPE" "$PRODUCT_NAME" "$TENANT_ID" \
+  --output json
+```
+
+Parse `Data` — it carries `policyIdentifier`, `name`, and `data` — and display:
+
+```text
+Effective policy:
+  Policy name:     <NAME>
+  Policy ID:       <POLICY_IDENTIFIER>
+  Product:         <PRODUCT_NAME>
+  License type:    <LICENSE_TYPE>
+  Tenant:          <TENANT_ID>
+  Data payload:    <DATA — pretty-print or attach as a link to a saved file>
+```
+
+If `Data` is `{ "Message": "No policy applies." }`, `null`, `{}`, or absent, inform the user that no policy applies for this `(license type, product, tenant)`. This happens when no rule matches and no default exists — the service returns HTTP 204.
+
+---
+
+## Get the effective deployed policy for a specific user (S2S)
+
+Requires an S2S bearer token. Returns the effective policy for the named user after the full user → group → tenant chain is walked.
+
+```bash
+export UIP_S2S_TOKEN="<TOKEN>"          # CLI reads this automatically
+
+uip gov aops-policy deployed-policy get \
+  "$LICENSE_TYPE" "$PRODUCT_NAME" "$TENANT_ID" \
+  --user-id "$USER_ID" \
+  --output json
+```
+
+The flag is `--user-id`, **not** `--user-identifier`.
+
+---
+
+## Get the tenant-level policy only (S2S)
+
+Explicitly bypasses any user/group chain consideration. Requires an S2S bearer token.
+
+```bash
+export UIP_S2S_TOKEN="<TOKEN>"          # CLI reads this automatically
+
+uip gov aops-policy deployed-policy get \
+  "$LICENSE_TYPE" "$PRODUCT_NAME" "$TENANT_ID" \
+  --tenant-only \
+  --output json
+```
+
+---
+
+## List every applicable policy for the calling user
+
+Returns every policy that applies to the caller for the given `(license type, product, tenant)`, in priority order. Unlike `get`, which returns only the single effective (top-priority) policy, `list` surfaces every applicable entry so you can see why a particular policy wins. **User token only — does NOT accept `--s2s-token`.** Returns an empty array when nothing applies.
+
+```bash
+uip gov aops-policy deployed-policy list \
+  "$LICENSE_TYPE" "$PRODUCT_NAME" "$TENANT_ID" \
+  --output json
+```
+
+Parse `Data` (an array of applicable policies in priority order). Each entry has `policyIdentifier`, `name`, `priority`, and `source` — one of `User`, `Group`, or `Tenant`. Render as a table:
+
+```text
+Applicable policies (highest-precedence first):
+  Source    Priority   Name                           Policy ID
+  User      20         Restricted StudioX Policy      <POLICY_ID>
+  Tenant    10         Baseline StudioX Policy        <POLICY_ID>
+```
+
+Use this when the user asks:
+
+- "Why is this policy winning for me?"
+- "What is my effective policy, and where does each entry come from?"
+- "Which of my policy settings came from tenant vs group vs user?"
+
+To inspect applicable policies for another user, log in as that user, or call `deployed-policy get --s2s-token --user-id <id>` (note: `get` returns only the single effective policy, not the full list).
+
+---
+
+## Debug
+
+| Error | Cause | Fix |
+|-------|-------|-----|
+| `401 Unauthorized` | User token expired (or S2S token missing/expired for S2S modes) | `uip login` for user-token modes; re-export `UIP_S2S_TOKEN` for S2S modes — see [aops-policy-commands.md — Authentication](./aops-policy-commands.md#authentication) |
+| `Data` is `{ "Message": "No policy applies." }` / `null` / `{}` on `get` | Service returned HTTP 204 — no rule matched and no default exists | Inform the user; confirm the tenant has a deployment via [aops-policy-deploy-guide.md](./aops-policy-deploy-guide.md) |
+| `Data` is `[]` on `list` | No policies apply in this context | Inform the user; verify that the user, product, and license type are all valid in the calling tenant |
+| `--user-id` rejected / `unknown flag --user-identifier` | Called without an S2S token, or used the old flag name | The flag is `--user-id`, not `--user-identifier`. Either drop `--user-id` (query the caller's own policy) or `export UIP_S2S_TOKEN="<TOKEN>"` before the call (fallback: pass `--s2s-token "$UIP_S2S_TOKEN"`) |
+| `--tenant-only` rejected | Passed without `--s2s-token` | Same as above — `--tenant-only` is an S2S-only mode |
+| `--s2s-token` rejected on `list` | `deployed-policy list` does not accept S2S tokens | Remove `--s2s-token`; re-run under `uip login` |
+| User cannot provide a tenant identifier | Tenant GUID unknown | Retrieve from Orchestrator or UiPath Cloud portal |
+
+---
+
+## Related commands
+
+- [aops-policy-commands.md](./aops-policy-commands.md) — full `deployed-policy` command reference and authentication modes.
+- [aops-policy-deploy-guide.md](./aops-policy-deploy-guide.md) — assign a policy before querying it.