List organization notification action policy

Outcome

List only explicit organization-level action-delivery rules, including disabled rows; stored policy differs from effective resolution.

These examples prove local handler behavior with real isolated notification SQL and explicitly simulated identity dependencies.

Before you start

• Verify pinned identity, the exact action and intended organization/user. Organization policy requires its manager/platform authority; user policy permits self/platform or organization management. Ordinary preference resolution for another user requires platform authority, not organization admin alone.

• Before a whole-scope replacement capture complete prior semantic settings, including disabled rules and JSON objects. Review intended wildcard dimensions and effects. Empty rows clears that explicit scope; replacements are sequential, can fail partially and always create new rule ids.

• Ordinary user resolution must omit Notify-only default_channel/transactional. Separate local service-context captures prove real ephemeral Notify signature checks, not a public gateway transport or live service credential. Do not copy service-only inputs into user OAuth calls.

• Stored policy, candidate channels, resolved delivery mode, actual Notify dispatch/receipt, timers and application action approval are separate outcomes. This family sends no messages and performs no application action.

Discover the target

topolo whoami --json
topolo apps --json
topolo actions get app_topolo_auth.organization_notification_action_policy.list --detail --json

Discover intended exact organization/user. Read organization_notification_action_policy.list and user_notification_action_policy.list for their separate scopes, plus ordinary global/organization preferences and stored channel flags. Resolve a specific actual producer/event/surface/category/priority context without Notify-only defaults on user OAuth.

Input fields

Effects

• Reads only organization-level stored rules, including disabled rows; no effective dispatch.

Interpret the response

Lists only rows with user_id null for the exact management-authorized organization, ordered by source/event/surface/category/priority/channel with no pagination. Disabled rows remain listed.

Rows include rule_id, complete wildcard/default dimensions, boolean flags and both nullable serialized JSON TEXT and parsed policy objects. Stored settings do not prove effective resolution, action execution, timers or delivery.

Worked examples

These are complete raw target-handler responses, not CLI/gateway envelopes or live authorization proof. Synthetic users/organizations exist only in isolated fixtures. Ordinary examples use simulated user identity while real authority, SQL and resolution are exercised. Discover actual intended targets, save only reviewed input as payload.json, validate and inspect the unchanged plan before an authorized call. --confirm assumes intended approval. Stored rows and computed modes do not prove dispatch, receipt, timers or application action execution.

Only organization-level rule rows are listed

Input · payload.json:

{
  "orgId": "org_example"
}

CLI:

topolo actions validate app_topolo_auth.organization_notification_action_policy.list --data @payload.json --json
topolo actions plan app_topolo_auth.organization_notification_action_policy.list --data @payload.json --json
topolo actions call app_topolo_auth.organization_notification_action_policy.list --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.organization_notification_action_policy.list",
    "input": {
      "orgId": "org_example"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Organization action policy fetched",
  "data": {
    "orgId": "org_example",
    "rows": []
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Organization policy includes wildcard rows but not per-user rows

Input · payload.json:

{
  "orgId": "org_example"
}

CLI:

topolo actions validate app_topolo_auth.organization_notification_action_policy.list --data @payload.json --json
topolo actions plan app_topolo_auth.organization_notification_action_policy.list --data @payload.json --json
topolo actions call app_topolo_auth.organization_notification_action_policy.list --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.organization_notification_action_policy.list",
    "input": {
      "orgId": "org_example"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Organization action policy fetched",
  "data": {
    "orgId": "org_example",
    "rows": [
      {
        "rule_id": "nap_SfATfU4PBhTYRflm",
        "organization_id": "org_example",
        "user_id": null,
        "source_app_id": "*",
        "event_type": "*",
        "surface": "*",
        "category": "*",
        "priority": "*",
        "channel": "*",
        "delivery_mode": "digest",
        "required_action": false,
        "quiet_hours_json": null,
        "digest_json": null,
        "escalation_json": null,
        "quiet_hours": null,
        "digest": null,
        "escalation": null,
        "enabled": true,
        "updated_at": 1790972360
      }
    ]
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Read partial organization rule set after its replacement failure

Input · payload.json:

{
  "orgId": "org_example"
}

CLI:

topolo actions validate app_topolo_auth.organization_notification_action_policy.list --data @payload.json --json
topolo actions plan app_topolo_auth.organization_notification_action_policy.list --data @payload.json --json
topolo actions call app_topolo_auth.organization_notification_action_policy.list --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.organization_notification_action_policy.list",
    "input": {
      "orgId": "org_example"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Organization action policy fetched",
  "data": {
    "orgId": "org_example",
    "rows": [
      {
        "rule_id": "nap_ZuqNFIhHJCwnNZxK",
        "organization_id": "org_example",
        "user_id": null,
        "source_app_id": "*",
        "event_type": "*",
        "surface": "*",
        "category": "*",
        "priority": "*",
        "channel": "*",
        "delivery_mode": "digest",
        "required_action": false,
        "quiet_hours_json": null,
        "digest_json": null,
        "escalation_json": null,
        "quiet_hours": null,
        "digest": null,
        "escalation": null,
        "enabled": true,
        "updated_at": 1790972360
      }
    ]
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Verify the result

• Require orgId and row organization_id to match the selected organization and each row user_id to be null.

• Compare full dimensions/settings, then separately resolve intended recipient/event contexts. Stored rows alone do not prove runtime enforcement.

Errors and recovery

Ordinary member cannot read organization action policy

Captured local refusal · HTTP 401:

{
  "credentialPrerequisite": "simulated-user-token",
  "input": {
    "orgId": "org_example"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Admin access required",
      "code": "AUTH_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Published recovery guidance

• AUTH_ERROR (HTTP 401): Verify pinned identity and respect the exact user/organization boundary. A valid other-service signature is not Notify trust; do not switch credentials or infer OAuth expiry from an authenticated target denial.

• VALIDATION_ERROR (HTTP 400): Correct reported fields and unique complete dimension keys. Ordinary user resolution must omit defaults/transactional; only an owning trusted Notify invocation may supply them and must provide explicit transactional true/false. Revalidate and review any replacement.

• SERVER_ERROR (HTTP 500): Preserve request/result and read the exact stored scope. A replacement may have removed prior rows and inserted only part of the intended set; separately review finishing or restoring complete captured semantic settings. Do not rely on old rule ids.

Recovery boundaries

Read-only stored or computed policy. Refresh relevant exact scopes after approved changes; no dispatch, delivery, timer or application action is executed here.

Discovery and evidence

This record belongs to app_topolo_auth. Fixtures prove actual authority, action-policy validation, canonical notification/core SQL, scoring/required-action guard, address/timezone resolution and partial replacement behavior. User tokens/targets/unused addresses are simulated. Trusted Notify captures use real ephemeral local RSA generation, Auth minting and local JWKS verification; no live credential/key is read or serialized. Current Notify source informs optional metadata field meanings, while its scheduling/dispatch is not exercised. No live storage, ownership, gateway credential parity, notification, timer, deployment or production publication is proved.