Gateway policy simulator

Choose connector_id, actor_type (user or service_agent), action_name, optional payload JSON, and advanced environment, risk_score, and amount. The result shows decision, matched grants, and explanation.decision_path.

POST /api/v1/operator/policy_simulations reads action_name or action (required), connector_id or connector_slug, actor_type=service_agent plus service_agent_id, payload, environment, amount, and risk_score. Missing action returns invalid_action_name. Response: decision, connector, matched_grants, matched_policy, matched_conditions, unmatched_conditions, reviewer_roles, explanation (including decision_path and freeze_reason). Owner or admin membership is required (403 admin_required).

Permission grants and approval policies have no /api/v1/operator REST. Create and update them at /app/gateway/access and /app/gateway/policies (workspace admin). /app/gateway, /app/approvals, and /app/approvals/:id are the operator screens. Policies persist action_patterns, risk_level medium|high|critical, reviewer_roles, and condition keys actor_type, environment, environments, payload, risk_score_gte, amount_gte, amount_lte.