Given symptoms that policies are not being enforced on an auto-discovered app, diagnose common causes (wrong/missing apiId, missing platform credentials, flowRef not pointing at the Listener flow, mismatched environment) and select the fix.