Skip to main content

Policy Lifecycle & Governance

Summary​

Policy Lifecycle & Governance manages how policies transition through states from creation to production deployment. It provides approval workflows, version tracking, and audit capabilities that enterprises need for compliance and change management.

Why It Exists​

Organizations deploying authorization policies face several challenges:

  • Change control — Unauthorized policy changes can create security vulnerabilities or break applications
  • Compliance requirements — Regulated industries require approval trails for access control changes
  • Rollback capability — Production issues require the ability to revert to known-good policy states
  • Multi-environment promotion — Policies must move safely from development through staging to production

Policy Lifecycle & Governance addresses these needs with structured workflows and state management.

Where It Fits in Keymate​

Policy Lifecycle & Governance operates within Access Manager as the first stage of policy processing. It receives policy definitions from Admin Console, manages their state transitions, and feeds approved policies to the Compile & Artifact Pipeline.

Boundaries​

This component handles:

  • Policy state transitions (draft, review, approved, published, deprecated)
  • Approval workflow orchestration
  • Version tracking and history
  • Audit event generation for policy changes

This component does not handle:

  • Policy syntax validation (Compile & Artifact Pipeline)
  • Runtime policy evaluation (Policy Engine)
  • Policy distribution to runtime components (Distribution & Activation)

How It Works​

Policy States​

Policies progress through defined states:

StateDescription
DraftInitial creation, editable, not evaluated
ReviewSubmitted for approval, locked for editing
ApprovedApproved by authorized reviewer, ready for compilation
PublishedCompiled and available for activation
DeprecatedMarked for removal, not assignable to new resources

State Transitions​

Approval Workflows​

Governance workflows define who can approve policy changes. Workflows are configurable per Tenant and can require:

  • Single approver
  • Multiple approvers (all must approve)
  • Role-based approval (specific roles required)

Version Management​

Each policy maintains a version history. When a published policy is modified:

  1. A new draft version is created
  2. The published version remains active
  3. The new version follows the standard lifecycle
  4. Upon publication, the new version replaces the previous

Audit Trail​

All state transitions generate audit events capturing:

  • Who made the change
  • What changed
  • When the change occurred
  • The resulting state

Diagram​

Example Scenario​

Scenario​

A security team member creates a policy restricting access to financial data. The policy requires approval from both the security lead and compliance officer before deployment.

Input​

  • Actor: Security team member
  • Resource: New ABAC policy for financial data
  • Action: Submit for approval
  • Context: Production tenant, multi-approver workflow configured

Expected Outcome​

  • Result: Policy enters Review state, notifications sent to required approvers
  • Why: Governance workflow requires multiple approvals for production tenant policies

Common Misunderstandings​

  • Approved means active — Approval is a governance gate; policies must still be compiled, published, and activated
  • All tenants require approval — Governance workflows are configurable; development tenants may allow direct publication
warning

Skipping governance workflows in production environments creates compliance and security risks. Configure appropriate approval requirements for each tenant.

Design Notes / Best Practices​

  • Configure stricter governance for production tenants
  • Use role-based approval for separation of duties
  • Maintain clear ownership for policy domains
  • Review audit logs regularly for compliance reporting
tip

Start with simple single-approver workflows. Add multi-approver requirements only for high-risk policy domains.

  • Regulatory compliance for access control changes
  • Separation of duties in policy management
  • Change management for authorization rules
  • Policy rollback after incidents

Compile & Artifact Pipeline

How approved policies become runtime artifacts

Distribution & Activation

How policies reach runtime components

Policy Model

Policy concepts and structure