Policy Frequently Asked Questions

These answers cover the application programming interface (API), governance, delivery, and administration. For terms such as draft head, compilation minor, and native binding, use the glossary.

Where Is the Policy API Exposed?

Use the gateway base configured for your installed release. Find the route and discovery links in the API guide. Do not assume the API base from the documentation URL.

Can Different People Submit and Approve?

Yes. The author and reviewer can use different authenticated accounts. Each needs the capabilities for the operation they perform. Policy ownership alone does not grant approval authority. Refer to roles and permissions.

Does Approval Mean Data Protection Is Active?

No. Approval commits a governed revision and queues asynchronous delivery. Publication and target-specific evidence require separate verification. Refer to states and revisions.

Can a Draft Change the Current Governed Policy?

Saving proposed work does not replace the governed revision. The replacement must complete its own review and approval. Refer to lifecycle and governance.

Why Did a Compilation Minor Appear Without Another Approval?

Automatic recompilation can generate changed output from already approved intent. It preserves approval identity and leaves open drafts unchanged. Refer to automatic recompilation.

Does Retry Compile My Corrected Draft?

No. Deployment retry continues retained work for the existing generation. Corrected authored input requires the applicable save, submission, and approval workflow. Refer to recovery playbooks.

Can I Inspect Diagnostics With Only a Support Reference?

No. Restricted diagnostics also require audit authority. An author can collect safe error context and ask an authorized operator for help. Refer to diagnostics.

Does Policy Require PostgreSQL?

Yes. PostgreSQL runs inside the deployed Policy stack. Back up retained state before consequential recovery or removal. Refer to Installation.

Is pmx_app Another Account That I Must Create?

No. pmx_app is a fixed PostgreSQL permission role, not a login account. Database startup creates it with NOLOGIN and grants membership to the configured runtime login. Bootstrap applies the restricted application grants. It has no password or credential Secret, and backup must not inherit it. Refer to database accounts.

What if Policy Is Installed After Traverse?

Check the known identity provider (IdP) backfill issue. Save the existing IdP connection details again in Traverse.

How Do I Verify Policy Is Healthy?

Distinguish process liveness, readiness, dependency checks, and completed delivery. A healthy service does not prove that a particular policy protects its targets. Refer to installation verification and System operations.

How Is Authentication Handled?

Use the platform’s supported sign-in or gateway authentication path. Do not impersonate forwarded identities or share another user’s credentials. Refer to API authentication.

How Do I Remove Policy Completely?

Decide retention and downstream withdrawal requirements before uninstalling. Removing a release does not itself prove downstream deprotection. Refer to Uninstallation.

Return to Policy or Troubleshoot.