Can I write custom constraints with this API?

Yes. POST to /v2/{+parent}/customConstraints with a CEL condition over the target resource type. The constraint then becomes available to bind via a policy on any node beneath the parent organisation.

What are the rate limits for the Organization Policy API?

Google Cloud applies a per-project quota for policy mutations. Effective-policy reads are cheap; bulk audits should still batch and back off if 429s appear, rather than fan out.

How do I apply a region restriction policy through Jentic?

Search Jentic for create organisation policy, load the schema for POST /v2/{+parent}/policies, and execute it with the gcp.resourceLocations constraint and your allowed list. Jentic returns the policy resource so you can confirm the apply.

Does this API enforce policies at runtime?

No - the API stores policy definitions. Enforcement happens inside the underlying services (Compute, GKE, Cloud Storage) when they evaluate the constraint at create or update time.

How do I read the effective policy on a project?

Call GET /v2/{+name}:getEffectivePolicy with the constraint name appended to the project resource path; the response returns the inherited policy after walking the hierarchy.

Can I limit what my agent is allowed to do with the Organization Policy API?

Yes. Because you run Jentic One yourself, your own rules decide which Organization Policy operations and credentials the agent may use. Since this API puts the target node in the URL path, you can pin the agent to a single parent organisation, folder, or project so it only creates, lists, and reads effective policies there. You choose the operations it may call, so destructive ones like deleting a policy or creating a custom constraint stay excluded unless you explicitly add them.