# GetAuditPolicy

## Overview

GetAuditPolicy retrieves a single audit policy by its unique identifier. Returns the full AuditPolicy record including status, entity name, operation type, company scope, and associated PolicyFieldRule records, or null if no matching policy exists.

This query requires the `manageAuditPolicies` permission at the appropriate scope.

## Business Rules

- Lookup by `id` performs an exact UUID match
- Returns the full AuditPolicy record including associated PolicyFieldRules
- Does not filter by status — returns DRAFT, ACTIVE, and INACTIVE policies
- Returns null when no matching policy is found
- Caller must hold `manageAuditPolicies` permission at the appropriate scope
- A caller with company-scoped `manageAuditPolicies` can only retrieve policies for their assigned companies
- A caller with global-scoped `manageAuditPolicies` can only retrieve global policies

## Process Flow

```mermaid
flowchart TD
    A[Receive lookup request] --> B{Caller has manageAuditPolicies?}
    B -->|No| C[Return error: INSUFFICIENT_PERMISSION]
    B -->|Yes| D[Query AuditPolicy by id]
    D --> E{Found?}
    E -->|Yes| F{Caller authorized for policy's scope?}
    F -->|No| G[Return error: UNAUTHORIZED]
    F -->|Yes| H[Load associated PolicyFieldRules]
    H --> I[Return policy with field rules]
    E -->|No| J[Return null]
```

## External Dependencies

- None

## Error Scenarios

- **INSUFFICIENT_PERMISSION**: Caller lacks the required permission for this operation
- **UNAUTHORIZED**: Caller's permission scope does not cover the target resource

## Test Cases

- returns audit policy when found by id
- returns null when audit policy not found
- returns DRAFT policy
- returns ACTIVE policy
- returns INACTIVE policy
- includes associated PolicyFieldRules in response
- rejects when caller lacks manageAuditPolicies permission
- rejects when caller lacks permission for policy's company scope
- returns global policy when caller has global-scoped permission
- rejects when global-scoped caller retrieves company-scoped policy
