Entitlement required: readPwdPolicy (Read password policy) or managePwdPolicy (Manage password policy).

Note: You only need one entitlement, but you can have more than one.