Publish & versions
Policies are versioned deliberately, because they govern live agents. Editing one is not a silent in-place change.
The three states
| State | What it means | Can be attached? |
|---|---|---|
| Draft | Being worked on. Enforces nothing. | No — it won’t appear in an agent’s picker |
| Active | Published and enforcing on every agent that carries it | Yes |
| Deprecated | Retired. Agents already carrying it keep working; it’s no longer offered for new attachments | No new attachments |
The status tabs on the policies list filter by these, with a count on each.
Publishing
Publish the draft
On the policy card, ⋯ → Publish. The policy becomes Active and a snapshot of its contents is written as version 1.
Attach it
It now appears in both agent policy pickers. See Apply a policy to an agent.
A draft never enforces anything, even if an agent was attached to the policy before you started editing. Publishing is what makes rules live.
Editing a published policy
You can edit an Active policy directly — open it in the wizard as normal.
Saving does three things in one action: it creates a new version, applies your changes to it, and republishes. The policy stays Active throughout, and agents carrying it pick up the new rules straight away.
The wizard warns you before this happens, naming the version that saving will publish.
Changes reach live agents immediately. There’s no staging step and no delay — the moment you save, every agent carrying the policy is governed by the new rules. Edit deliberately on a policy that’s in production.
Version history
Every publish writes an immutable snapshot. Those snapshots are what enforcement reads from, which is why a half-finished draft can’t affect a running agent.
Version numbers appear on the policy card as v1, v2 and so on.
Deprecating
⋯ → Deprecate retires an Active policy. Agents already carrying it continue to work — deprecation stops it being offered for new attachments, it doesn’t pull it out from under anything.
Use it to phase a policy out: deprecate, migrate agents to its replacement, then let it sit.
A deprecated policy is read-only. Editing it would quietly bring a retired policy back into play, so that’s not offered. Create a new policy instead.
Deleting
Only drafts can be deleted, and you’ll be asked to confirm. Anything that has been published has a version history and possibly attached agents, so retiring it is deprecation, not deletion.
Common issues
- The policy doesn’t appear in an agent’s picker — it’s a draft, or it’s deprecated. Only Active policies are offered.
- You edited a policy and it went to Draft — that shouldn’t happen; editing an Active policy republishes it. If you see a policy sitting in Draft that you expected to be live, publish it.
- Delete isn’t available — the policy has been published. Deprecate it instead.
- You want to roll back — there’s no rollback control today. Edit the policy back to the settings you want and save; that publishes a new version with those contents.
Next
- Troubleshooting — when a policy seems to do nothing.