The calling API key's organisation's inference privacy verification.
What this organisation's inference privacy actually is right now. policy is null when none is set. capabilities lists chat, vision and embeddings, each exactly once, bound or defaulted. Vision has no default: unbound, no call can be made on it, so its provider and model are none, its evidenceState is unbound, and its labels say what the policy promises every call on it (a binding is then judged like any other). enforced is true only when a policy exists and every listed capability is admitted under it: under requireVerifiedZdr that means a routing-constrainable provider, fresh ZDR evidence and at least one ZDR endpoint for the exact model; under a deny-only policy only that the constraint can be carried. Read it with the policy flags, never alone. Closed tokens: retention is zdr-verified or not-enforced; trainingUse is verified-none or not-enforced; credentialScope is platform, org or none (no key resolves; never null). evidenceState is verified, the condition a verified-ZDR requirement would refuse it under (provider-unconstrainable, no-evidence, evidence-stale, model-no-zdr-endpoint), or unbound. evidence.observedAt is null only before any ZDR list has ever been read. OCR, speech and image generation are gated at call time but are not listed here, so enforced says nothing about them. Route attribution is an alarm, never a control: lastRouteViolationAt and routeAttribution never change enforced; every policy PUT, an unchanged one included, stamps policy.updatedAt, which is how an admin acknowledges a violation.