A policy is attached to the *root* :class:`ObservingAccount`; subaccounts
inherit it through ``ObservingAccount.effective_observing_policy``.
**Allow-list semantics** — the five ``allowed_*`` columns fall into two groups:
* **Required, enumerated (no wildcard):** ``allowed_data_policies`` and
``allowed_request_types`` are ``NOT NULL`` and the API requires at least one
value (``min_length=1``). There is no "all allowed" sentinel for these — a
policy must spell out which data policies / request types it permits.
``allowed_data_policies`` keeps its historical ``[public]`` ORM default.
* **Tri-state (nullable):** ``allowed_target_position_types``,
``allowed_coordinate_types``, and ``allowed_catalog_object_types`` follow the
null convention — ``NULL`` = unrestricted (all allowed), ``[]`` = none
allowed, ``[a, b, …]`` = only the listed values. They default to ``NULL``.
NOTE: these rules are currently *recorded but not enforced* on the
submit / publish / schedule paths — see
``docs/agents/observing-policy/observing-policy-review.md`` (finding #1).