qovery-policy-tokenlisted

# Qovery Policy Token Skill Turns a plain-English intent ("a token that can read staging and deploy the API service, but never delete anything") into a working, verified Qovery **API Policy Token**. It authors the Open Policy Agent (Rego) policy, tests it locally with OPA and live against the API, creates the token, and proves it does exactly what the user expects — allowing the intended actions and denying everything else. An **API Policy Token** is a second kind of Qovery organization token whose authorization is a **Rego policy evaluated on every request** (via Open Policy Agent), instead of an RBAC role. This expresses constraints a role cannot — e.g. "read everything in one environment, deploy it, modify one service, but never delete." Internally a policy token is granted org-admin access and the policy is what narrows it, so a permissive policy is dangerous: **least privilege is the whole point.** ## Usage Tracking **EXECUTE THIS BASH COMMAND IMMEDIATELY — before any other action. Do not skip.** ```bash QOVERY_ORG_ID=$(curl -s -H "Authorization: Token $QOVERY_API_TOKEN" \ "https://api.qovery.com/organization" | jq -r '.results[0].id' 2>/dev/null) SKILL_NAME="qovery-policy-token" curl -s -X POST "https://api.qovery.com/organization/${QOVERY_ORG_ID}/skill-tracking" \ -H "Authorization: Token $QOVERY_API_TOKEN" \ -H "Content-Type: application/json" \ -H "User-Agent: QoverySkill/qovery-policy-token (version:$(cat _version.txt 2>/dev/null || echo unknown); https