hopefully working policy bicep

Author: EMaher

.squad/agents/apimexpert/history.md

@@ -99,11 +99,11 @@ the SDK surface, reference docs, or ad-hoc observation.
 
 **Research output:** `.squad/decisions.md` entry (merged from inbox), full analysis in `specs/sku-upgrade.md`
 
-### 2026-05-19: `policyRestrictions` — `scope` is the full ARM resource ID of a policy document
+### 2026-05-19: `policyRestrictions.scope` grammar
 
-`Microsoft.ApiManagement/service/policyRestrictions`: `scope` is the ARM resource ID of an existing policy document (e.g. `${apim.id}/policies/policy`, or the equivalent for an api/operation/product policy). Enum-like values (`'All'`, `'Tenant'`, etc.) and relative paths (`'/policies/policy'`) compile but fail at deploy with `"The specified scope is not supported for policy restriction."`
+`Microsoft.ApiManagement/service/policyRestrictions@2025-09-01-preview`. Schema says `"Path to the policy document."` but the API validates `scope` as a **relative ARM path to an existing API, operation, or product**.
 
-Inferred from the sibling `SubscriptionContractProperties.scope` in the same definitions file (description says `"Scope like /products/{productId}"` but real examples use full ARM IDs, e.g. `/subscriptions/{sub}/.../service/{name}/products/{id}`). All Microsoft policy-restriction examples use the placeholder string `"Sample Path to the policy document."`, so this is the best inference; verify by deployment. Classic Developer/Premium SKU only.
-
-- <https://learn.microsoft.com/rest/api/apimanagement/policy-restriction>
+- Accepted: `/apis/{apiId}`, `/apis/{apiId}/operations/{opId}`, `/products/{productId}`, `""`.
+- Classic Developer/Premium SKU only.
+- Docs: <https://learn.microsoft.com/rest/api/apimanagement/policy-restriction> · <https://learn.microsoft.com/azure/templates/microsoft.apimanagement/service/policyrestrictions>
 

tests/integration/all-resource-types/expected-structure.json

@@ -292,7 +292,7 @@
           "files": ["policyRestrictionInformation.json"],
           "spotChecks": {
             "policyRestrictionInformation.json": {
-              "properties.scope": "exists",
+              "properties.scope": "/products/src-product-starter",
               "properties.requireBase": "true"
             }
           }

tests/integration/all-resource-types/source-apim.bicep

@@ -667,7 +667,7 @@ resource policyRestriction 'Microsoft.ApiManagement/service/policyRestrictions@2
   parent: apim
   name: 'src-restriction-ip'
   properties: {
-    scope: servicePolicy.id
+    scope: '/products/${productStarter.name}'
     requireBase: 'true'
   }
 }