Read a signed short-lived policy for this installation only.

Private and no-store. Set ORIGIN to https://api.agentalog.com. Exact path, no query and no write. Revalidate credential expiry, revocation and account epoch on each read. Ed25519 signature; at most 500 rules, 1 MiB and 15 minutes, shortened to credential expiry. Client 0.4.0 pins the public key and verifies product/project/installation/epoch through its trusted connection. Reject expired, future, changed, differently scoped or older policies. An already cached policy can remain valid until expiry after an online revocation. policy downloads a signed decision. check recollects the selected configurations and target item before checking their exact candidates. The policy and check commands do not activate tools or install hooks. Optional hooks-install can install project hooks after preview consent. In enforce mode, covered calls require exact reviewed configuration and tool metadata. Removing a reviewed configuration prevents confirmation until that configuration is restored and reviewed. This does not freeze a remote MCP's code or guarantee universal blocking. Available only when the optional review service is configured. Returns: { esquema, politica, assinatura }