Policy Working Practices

Use these practices alongside the authoring and governance guides.

Policy Authoring Practices

Prefer explicit supported principals for a narrowly scoped first policy. Check classification identities and discovered scope rather than names alone. Scope includes selected classifications, applicable data, and intended principals. Review permission rows again after changing principal scope. Do not treat wildcard selection as a missing or empty scope.

Use a meaningful nonblank title. Inspect saved content and findings after Save. Do not interpret preview or an enabled Save button as submission eligibility. Refer to Data or artificial intelligence (AI) instructions.

Lifecycle Management Practices

Keep author and reviewer responsibilities explicit. Use each person’s own authenticated account. Owner/editor grants do not supply review or approval capability. Conversely, an author authority mapping does not prove an owner/editor grant on an existing policy. Do not grant broad administrator access merely to complete a handoff.

Concurrency evidence must match the resource and the content under review. An entity tag (ETag) validates a resource version. It does not grant authority. Draft and governed-policy validators are not interchangeable. The conditional-request reference defines each command’s header requirements and stale-work handling. Keep actionable reasons with requested changes and approval decisions. Refer to governance for command-specific prerequisites.

Operational Practices

When reporting a delivery error, include the policy identifier, approved version, deployment identifier, error message, and support reference. Ask the administrator named by delivery troubleshooting to resolve the error before retrying. Retry sends the previously saved configuration. Edited drafts require submission and approval.

Periodic recompilation preserves authored intent and approval identity. It can change compilation minors and queue delivery when source context changes. A compilation minor recompiles the same governed revision without approving new intent. Refer to automatic recompilation.

Verification

After approval, follow the Data or Guardrails verification guide rather than stopping at the approval notice. For Data, check every expected location’s protection status with the Traverse administrator. For Guardrails, confirm consumer retrieval and use Guardrails monitoring to check runtime behavior. After archive, check that archiving finishes. Another policy can still protect the same data.