What this agent enforces on an organization, installed policy packs counted (internal service)

The count of the policies in force on the decide scope, taken from the activation this agent enforces on the organization: its active typed document, its recorded detection overrides and the policy packs this process installed (#4249). The agent is the only process that loads a deployment's packs, so the orchestrator's and the customer portal's GET /api/v1/typed-policies/active/summary read this to count them.

packs_counted is always true here: this process knows which packs are installed, so a deployment that installed none, every Community one included, answers pack 0, a counted zero.

INTERNAL BY ITS CREDENTIAL, NOT ITS PATH. Only the internal-service credential (X-Internal-Service-ID + X-Internal-Service-Token) is answered; any other caller, a tenant's included, gets 401. The organization is the one the internal caller names in X-Org-ID. The route is deliberately not under /api/v1/typed-policies, which the agent forwards whole to the orchestrator: there it would either shadow the tenant summary route with a 401, or send the orchestrator's read back to the orchestrator, which would count no packs and say nothing.