Skip to content

Policy Endorsements

2. Policy Endorsements

Policy Endorsements is the governance workflow for reviewing and approving proposed changes to guard policies. Every policy change submitted from the Policy Studio enters this queue as a Policy Conflict and must be reviewed before it can be promoted to production.

2.1 Policy Conflicts Table

Each row represents a pending policy change proposal. Columns include:

Column Description
Proposal ID Unique identifier for this policy proposal
Policy Type The category of policy being changed (e.g., kernel, identity, probe)
Requested By The user who submitted the proposal
Status pending, approved, staged, or rejected
Submitted When the proposal was submitted

2.2 Filtering & Sorting

  • Status filter — View pending, approved, staged, rejected, or all proposals
  • Policy Type filter — Narrow by policy category
  • Search — Find by proposal ID, guard kernel name, or policy type
  • All columns are sortable
  • Column visibility can be toggled

2.3 Proposal Detail (Side Sheet)

Clicking a proposal opens the full detail view:

  • Status badge
  • Auto-Staged badge (if the system automatically promoted the proposal based on low-risk criteria)
  • Proposal ID

Proposal Metadata

  • Guard kernel name and version
  • Policy type
  • Requested by (user email)
  • Submission timestamp
  • Conflicting Commitment ID (the guard state being replaced)

Conflict Summary

A plain-language description of what the policy change entails and why it conflicts with the current production state.

Proposed Changes

The diff of the proposed changes, displayed as a formatted JSON block. For identity or probe set changes, the payload overrides are shown directly.

Metadata

Full JSON of the proposal's metadata context.

Latest Decision

If a previous decision has been recorded for this proposal (e.g., it was initially rejected and resubmitted), the latest decision is shown with its rationale.

2.4 Taking a Decision

For pending proposals, users with the approver or admin role can:

  1. Review the conflict summary and proposed changes
  2. Enter a written Decision Rationale (minimum 4 characters)
  3. Click Approve to promote the policy change to the staged state for production rollout
  4. Click Reject to block the change and return it to the submitter

RBAC: The auditor role can view endorsements but cannot approve or reject. Only approver and admin roles can take decisions.