Understand Policy on

States and Revisions

Mon, 01 Jan 0001 00:00:00 +0000

A policy can have governed content and an open replacement draft simultaneously. Saving that replacement does not make it the approved policy. Publication and observed protection remain separate from both authoring and approval.

Three Independent Questions

The following table distinguishes the questions answered by draft, governance, and delivery evidence:

Concern	Question	Relevant Information
Draft work	What proposal can the author edit or submit?	Inspect draft identity, current snapshot, and draft status.
Governance	Which content has completed approval?	Inspect the governed revision and its approval history.
Delivery and protection	What happened at the intended targets?	Check the latest operation and the Data observations or Guardrails consumer receipt.

Before first approval, no governed revision or protection evidence may exist. An empty protection value does not mean protection succeeded or failed. Do not derive these independent concerns from one displayed status.

Roles and Permissions

Mon, 01 Jan 0001 00:00:00 +0000

Authentication establishes who is making a request. Authorization determines whether that identity can perform the requested operation. Some commands also require access to the particular policy. A command capability answers whether an identity may perform an operation at all. A policy access grant answers whether that operation may affect this specific policy. Commands that require both checks must satisfy both.

Responsibilities Are Not New Roles

An author prepares and submits proposed work. A reviewer inspects a submission and can request changes with the required authority. An approver accepts the reviewed content with approval authority. An operator observes delivery and performs specifically authorized recovery tasks.

Classifications, Principals, and Methods

Mon, 01 Jan 0001 00:00:00 +0000

Authoring combines the data or runtime scope with intended principals and permissions. Catalog choices have operational meaning. They are not interchangeable display labels.

Classifications and Scope

A classification identifies a category of discovered data. For Data protection, its resolved locations determine where protection applies. Review that scope before submission, particularly after catalog changes. The same display name does not prove the same current location set. Scope is the resolved set of locations or runtime subjects to which the selected inputs apply. Record identifiers and representative locations, not just a classification’s display name.

Validation and Review Decisions

Mon, 01 Jan 0001 00:00:00 +0000

Each checkpoint answers a different question about a policy. A successful earlier checkpoint does not guarantee success at the next one.

Checkpoint Meanings

The following table explains what each checkpoint establishes and what to verify next:

Checkpoint	What It Establishes	What Remains to Check
Save	Retain accepted authored input as a draft snapshot.	Resolve incomplete or invalid work before submission.
Preview	Inspect target-specific compilation output for the supplied input.	Save the intended content and validate its current context.
Saved validation	Check the latest saved draft for an authorized reviewer.	Correct blocking findings or review conflicts that permit acknowledgement.
Submit	Accept eligible current draft work into review.	Obtain the authorized review decision.
Approve	Commit the reviewed governed revision and queue delivery.	Verify publication and target-specific protection evidence.
Publication	Deliver generated configuration to the receiving product.	Follow the Data or Guardrails verification guide.

Blocking and Reviewable Findings

Some findings require correction before the operation can continue. Other findings permit an explicitly recorded review acknowledgement. An acknowledgement records an authorized acceptance of a specifically reviewable finding. It does not suppress validation, widen permissions, or override a blocking finding. Use the returned conflict identifiers and the current operation contract. Do not acknowledge every finding merely to make a request succeed.

Policy Terminology

Mon, 01 Jan 0001 00:00:00 +0000

Policy uses different records for authored work, approved content, and target delivery. Similar names do not make those records interchangeable. This reference explains the distinctions used in task instructions and error messages.

Authoring and Governance

The following table defines terms for authoring and governance:

Term	Meaning and Boundary
Authored intent	Describe the author’s selected classifications, principals, methods, and permissions, before target-specific compilation.
Authoring lane	Distinguish Data authoring from artificial intelligence (AI) authoring. Their inputs and supported protection choices differ.
Classification	Identify a category of discovered data. Its current resolved locations determine Data scope.
Scope	Identify the data locations or runtime subjects affected by the selected policy inputs. A display name alone does not establish scope.
Principal	Identify a runtime subject, such as a configured directory group. Do not confuse it with the person administering Policy.
Draft	Hold proposed policy work that can proceed through saving, submission, review, and approval.
Draft identity and cycle	Keep the stable `draftPolicyId` separate from its `cycleNumber`. A later authoring cycle can retain the same draft identity.
Snapshot	Retain a particular saved state of authored work. Saving again does not create another approved revision.
Draft head	Identify the draft’s current saved snapshot. Inspect its current status and validator before changing it.
Governed revision	Record content that completed approval. An open replacement draft does not replace this content.
Compilation minor	Record changed compiled output under an existing governed revision without changing its authored intent or approval attribution.
Review acknowledgement	Record an authorized acceptance of a specifically reviewable finding. Do not use it to bypass a blocking conflict.

For example, saving a corrected draft changes proposed work. Approval creates governed content. Automatic recompilation can then change generated output without another author edit. Refer to states and revisions.