Get one environment's policy override

API key required. {env} is dev, staging, or prod. Returns the environment’s sparse override — only the verbs it explicitly sets — in policy, plus the effectivePolicy: the tenant default with the override applied on top, which is what checks naming this environment actually evaluate against. policyProvenance names the winning layer (tenant or environment) per verb. An override that was never configured returns an empty policy, version: 0 (“no override yet”), and an effectivePolicy equal to the tenant default.