Inspect Delivery Issues and Verify Withdrawal

Use this task when publication fails or an archived policy remains Archiving. Each delivery request has a generation number. Retries reuse the configuration saved for that request. Restricted operation inspection requires policy:audit.

Before You Begin

Complete these prerequisites before investigating delivery:

• Retain the policy identifier and visible error.
• Confirm audit capability before following Operations directions. Otherwise, give this task to your Policy administrator.
• Confirm policy:approve for publication retry or policy:archive for withdrawal retry. Audit access alone does not permit either command.

Inspect Before Retry

To inspect a failed delivery before retrying, follow these steps:

1. Open the policy’s Operations tab.
2. Select the latest request and record its deployment identifier, error message, and support reference.
3. Follow the publication troubleshooting table to identify the administrator who can resolve the reported problem.

If you cannot open Operations, send the policy name and visible error to your Policy administrator.

For direct application programming interface (API) use, inspect GET /policies/{policy_id}/operations under audit authority. Refer to recovery reference for diagnostics and command-specific prerequisites.

Do not interpret an unavailable diagnostics record as successful delivery. An operations 404 can mean no recorded deployment. A support reference does not grant access to restricted diagnostics.

Retry Eligible Retained Work

To retry eligible retained work, follow these steps:

1. Ask the administrator handling the failure to confirm that its cause is resolved.
2. Reopen Operations and check that no later publication or removal request exists.
3. Use Retry publication or Retry archive if Policy offers the action for that request.
4. Check the subsequent attempt for errors and follow Data or Guardrails verification.

Publication retry requires policy:approve. Withdrawal retry requires policy:archive. For direct clients, use the generation-specific deployment retry contract. An empty 204 response means the reset succeeded, not that delivery recovered. Retry sends the previously saved configuration. It does not include edits made after that request.

The server rejects replaced work or a generation with a newer successor. Treat a retryability hint as advisory, not permission to bypass command checks. For a missing or conflicting Policy Integration Manager (PIM) object identifier, ask your Policy administrator to follow the ownership-reconciliation playbook before retrying.

If policy intent needs correction, return to authoring, review, and approval. Retry does not use a newly edited draft. For ownership reconciliation, follow the operator recovery playbooks.

Verify Withdrawal

Start this task after an authorized user archives a policy.

To verify that withdrawal completed, follow these steps:

1. Open Operations and find the removal request created by archive.
2. Read its current status and error message.
3. If an error remains, follow the publication troubleshooting table linked above.
4. Reload the policy until archiving completes. If it remains Archiving, send the operation details to your Policy administrator.

While withdrawal remains incomplete, the policy can retain Approved governance and show Archiving delivery progress. Do not interpret archive initiation as completed removal. Guardrails withdrawal publishes revised aggregate output without the retired contribution. Policy does not wait for a Guardrails consumer to fetch that revised output before completing Guardrails withdrawal. If the policy also uses Data protection, a successful Guardrails update does not complete the Data removal.

Withdrawal removes this policy’s contribution. Other policies can retain protection over shared resources. Archive completion does not certify destruction of all cryptographic material. It also does not prove that every location became unprotected.

Authorized archive evidence records an attributable claim for the active withdrawal. It does not replace target completion evidence or certify deprotection. Follow the archive evidence contract when an operator needs that record.

If the request has been replaced, or the error identifies an unknown PIM object, stop retrying and send the error to your Policy administrator. Return to delivery or operations.