Troubleshoot Policy on

Troubleshoot Authoring and Review

Mon, 01 Jan 0001 00:00:00 +0000

Use this task when saving, submission, review, or approval fails. Application programming interface (API) callers must retain response headers and details. An existing governed revision can remain current while replacement draft work fails. Do not infer a delivery failure from a draft validation error.

Prerequisites

Prepare the following:

Identify the policy and the exact action that failed.
Use your own authenticated identity.
Read roles and permissions.
Retain the returned error and any support reference.

Check Permissions Before Retrying

Check these separate authorization requirements:

Known Issues and Workarounds

Mon, 01 Jan 0001 00:00:00 +0000

Use this reference before installation and when a documented limitation matches your symptoms. An issue entry is not a general instruction to replace credentials or relax permissions. Record installed component versions when reporting an occurrence.

Identity Provider Secret Backfill After Traverse

Condition and Reported Behavior

This issue concerns Policy installed after an existing Traverse deployment.

The reported behavior leaves the shared identity provider (IdP) connection Secret unpopulated. Existing Traverse connection details do not automatically backfill it when Policy is installed later. Policy can therefore lack the connection metadata required for member-source provisioning. Workload readiness alone does not establish that this metadata exists.

Recover Publication and Withdrawal

Mon, 01 Jan 0001 00:00:00 +0000

Use this task when a policy reports a publication or removal error after approval or archive. Policy performs these operations in the background, so the approval or archive request can succeed before delivery finishes. Withdrawal means removing this policy’s previously published configuration from the receiving products.

Prerequisites

Prepare the following:

Identify the policy and failed publication or withdrawal.
Obtain policy:audit for operation inspection, or involve an authorized auditor.
Obtain policy:approve for publication retry or policy:archive for withdrawal retry.
Follow the diagnostic request setup for application programming interface (API) examples.

In Policy Panel, open the affected policy’s Operations tab for visible evidence. If you cannot open it, send the policy name and visible error to your Policy administrator. The remaining steps require the permissions listed above.

Reconcile a Policy's Native Ownership

Mon, 01 Jan 0001 00:00:00 +0000

Use this task when publication reports missing or conflicting native ownership. Policy Integration Manager (PIM) identities differ from Policy’s saved reference keys. Do not repair a mismatch by guessing an identity from its name. A binding associates a saved Policy reference with a native object’s identifier. The ownership registry stores these associations. Its version changes independently of a draft or policy revision.

Prerequisites

Prepare the following:

Identify the affected policy and operation.
Obtain policy:system-configure for inspection and decisions.
Obtain additional policy:archive authority if you intend to withdraw.
Arrange an authorized integration owner for native inventory or configuration problems.
Use the application programming interface (API) request setup.

An ordinary author should preserve the error and hand off this task. Policy ownership grants do not supply system-configuration authority.

Remove Verified-Stale Ownership Mappings

Mon, 01 Jan 0001 00:00:00 +0000

Use this task for stale saved ownership mappings across policies. Cleanup removes Policy’s mapping, not a native Policy Integration Manager (PIM) object. For a current policy incident, start with policy ownership reconciliation. A binding maps a Policy reference key to a native object’s identifier. Stale means current, complete evidence proves the saved mapping no longer applies. Age alone does not establish that.

Prerequisites

Prepare the following:

Obtain policy:system-configure for all operations in this task.
Confirm complete live PIM inventory access with the integration owner.
Use the application programming interface (API) request setup.
Retain an approved incident reason and the exact selected evidence.

Do not use this task to bypass active publication or withdrawal. Do not delete native objects to make a cleanup decision succeed.

Troubleshoot Automatic Recompilation

Mon, 01 Jan 0001 00:00:00 +0000

Use this task when changed source information does not produce expected approved output. Automatic recompilation periodically checks approved policies against fresh inputs. It differs from reviewer-requested saved validation and retained-deployment retry.

Prerequisites

Prepare the following:

Identify the approved policy and the source change you expected it to reflect.
Read automatic recompilation operations.
Ask the platform operator to inspect effective scheduling and bounded logs.
Use policy:audit only when operation inspection becomes necessary.

An author can report the policy, source change, and visible history. An author need not obtain cluster access or system-configuration authority.

Common Policy Errors

Mon, 01 Jan 0001 00:00:00 +0000

Use the action and response together when identifying an error. Keep application programming interface (API) response details with your incident evidence. The same status code can describe different problems. Keep returned details and support references before attempting recovery.

Find the Matching Symptom

A member source is a directory or identity source configured in Policy Integration Manager (PIM). Its connection metadata differs from Policy’s own service login or a human user’s token.

Collect Policy Diagnostics

Mon, 01 Jan 0001 00:00:00 +0000

Collect enough evidence to identify the failed task and responsible operator. Start with information you can access. Do not request broad administrator access merely to report an issue.

Prerequisites

Prepare the following:

Use your own supported Policy session or application programming interface (API) credentials.
Obtain policy:audit only when your assigned investigation requires restricted diagnostics.
Obtain namespace read access only for the optional platform checks.
Follow your organization’s incident process for sensitive evidence.

Steps

Collect evidence available without cluster access:

Recover Policy Safely

Mon, 01 Jan 0001 00:00:00 +0000

Use this directory to select a recovery task. Each linked playbook identifies the required authority and completion evidence. Application programming interface (API) requests require the command’s specific authority. Do not substitute a deployment retry for a corrected policy approval. Do not substitute a Helm rollback for database recovery. Retry continues retained delivery work. Reconciliation compares saved ownership or protection evidence with current observations. Database recovery restores retained local state and still requires checking external effects.

Troubleshoot Installation, Identity, and Routing

Mon, 01 Jan 0001 00:00:00 +0000

Use this task when Policy cannot start, authenticate callers, or serve configured paths. Separate platform availability from policy delivery failures. Healthy workloads do not establish protection for an approved policy.

Prerequisites

Prepare the following:

Obtain the configured Policy address and installed release details.
Use your own supported gateway session or application programming interface (API) credentials.
Involve a platform operator for namespace, release, gateway, and log inspection.
Follow diagnostics before changing configuration.

For cluster inspection, have the platform operator complete the explicit context setup. Every cluster example below requires that approved CTX value.