One regime's status

The single-id read a picker captions its options with. status: null means nothing has DEFINED this regime — a regime named only by a scope link that arrived first is LATENT, not absent (A5), which is why that case is a 200 and not a 404. disclosure_policy is the policy PARSED out of the regime's name; null next to a name you believe says [disclosure:required] means the guarantee is not in force.

Requires the coord:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying coord:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include coord:read — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).