If there are no webhooks for the policy, would we still want to return empty webhook lists for all policies, right?  Otherwise the user couldn't tell this apart from the case where no query arg was passed.

Non-blocking nitpick - perhaps these could be named `webhook_results` and `policy_results`?  `webhooks` overrides the function argument `webhooks`, it might be very slightly confusing.