Policy changes: four-eyes approval and change freezes
Overview
Section titled “Overview”The enforcement policy decides what the browser extension, the AI proxy and coding-agent hooks block. A single save can turn a block into a warning across the whole organisation. Change control puts a second person in front of that save.
Govern → Policies & rules → Policy changes (/compliance/change-control) has three tabs:
- Waiting for approval: changes submitted and not yet decided.
- All changes: every change submitted for approval and what was decided about it, newest first.
- Settings: how policy changes are made in this organisation.
Change control covers:
| What changes | Where it is changed |
|---|---|
| Organisation policy | The organisation’s enforcement policy, under Govern → Policies & rules → Policies |
| Environment overrides | An environment’s overrides of that policy |
| Group or person policy | The settings for one directory group or one person |
| Detection rule | A detection rule under Govern → Policies & rules → Detection rules: a new rule, a change, or a deletion |
| Feature flag | A feature flag under Developer tools → Telemetry → Feature flags: a new flag, a change, switching it on or off, archiving or restoring it, or a revert, including changes a scheduled rollout or an automation makes as its author; and a flag segment’s creation, change or deletion |
A change is a Change, a New rule, a Delete, or a Revert to an earlier version.
Who can do what
Section titled “Who can do what”| Permission | Allows | Held by |
|---|---|---|
policies.read (View agent policies) | See the page, the pending and decided changes and their diffs, and withdraw your own pending change | Owners, administrators, compliance officers, analysts, the Security role, members, viewers and managed-service providers |
policies.approve (Approve policy changes) | Approve or reject someone else’s pending change | Owners and administrators |
organisation.manage (Manage the organisation) | Change the Settings tab | Owners and administrators |
Detection-rule changes are listed only for people who may also view computers and people (collector.read), and feature-flag and segment changes only for people who may view feature flags (flags.read).
Nobody can approve or reject their own change, whatever their role. Approving must be done by a person who is signed in. An API key cannot approve.
Turn on approval
Section titled “Turn on approval”Go to Govern → Policies & rules → Policy changes and select Settings. If you cannot manage the organisation, the settings are read-only.
Turn on Require approval. From then on, a save of the enforcement policy, an environment’s overrides, a group or person policy, or a detection rule waits as a pending change. It applies only when another person with Approve policy changes approves it.
Under Change comments, choose Not asked for, Optional or Required. The comment is kept with the change and with the policy version it creates.
Select Save settings. Changing these settings is recorded in the audit log.
Make a change that needs approval
Section titled “Make a change that needs approval”When approval is required, the pages where policy is edited say Changes here need a second person’s approval before they apply.
- Make the change and save it as usual. If comments are optional or required, fill in Change comment.
- Shield360 shows Submitted for approval. It applies once someone else approves it. Nothing changes for browsers, proxies or computers yet.
- The page links to N waiting for approval. Select Review to open the change.
A save that changes nothing is refused: This changes nothing, so there is nothing to approve.
To take back a change you submitted, open it and select Withdraw. Only its author can withdraw a change.
Approve or reject a change
Section titled “Approve or reject a change”Each change shows what it changes, who submitted it and when, the author’s comment, and a diff with Setting, Before and After columns. If either side of a value looked like a secret, neither side is shown. The diff says Redacted values changed instead.
Add an optional note and select Approve and apply. The change is applied exactly as submitted, at once: Approved. The change applies now. The version it creates records who approved it.
Select Reject, give the reason (required), and select Reject change.
A change is applied only while the live policy is still the one it was made against. If someone changed the policy after the change was submitted, approving it does not apply it. The change is marked Out of date instead: The policy changed after this was submitted, so it was not applied. Make the change again against what applies now.
If you submitted the change, the page says You submitted this change; someone else has to approve it. If your role cannot approve, it says Your role cannot approve policy changes.
Statuses
Section titled “Statuses”| Status | Meaning |
|---|---|
| Waiting | Submitted, not yet decided |
| Applied | Approved by a second person and applied |
| Rejected | Rejected, with the reason |
| Withdrawn | Taken back by its author |
| Out of date | Not applied, because the policy changed after it was submitted |
Every submission, approval, rejection and withdrawal is recorded in the audit log.
Freeze changes
Section titled “Freeze changes”A change freeze stops policy changes for a period, for example over a release or an audit. While a freeze is in force, nobody can change, approve, revert or submit policy and detection-rule changes, except the people you exempt.
- In Settings, turn on Freeze changes.
- Optionally set From (optional) and Until (optional). Leave both empty to freeze from now until you turn the freeze off.
- Give a Reason, shown to everyone. A reason is required, because everyone who is stopped sees it.
- Under Not stopped by the freeze, pick up to 50 members who may still make changes.
- Select Save settings.
During a freeze, policy pages show a Change freeze banner with the reason and end date. Someone who is exempt sees You are exempt from this freeze. A freeze that has not started yet is announced as A change freeze starts …. Starting, changing and ending a freeze are recorded in the audit log.
Version history and revert
Section titled “Version history and revert”Every saved change to the organisation policy or an environment’s overrides creates a version. On the Policies page, select History to see the versions, what each changed (sensitive values masked), who made it, who approved it, and which one Applies now.
Revert to this version restores an earlier version as a new version. A revert is a change like any other. A freeze stops it, a required comment must be given, and with approval required it waits for a second person. Reverting needs the permissions to change the policy: Manage agent policies (policies.manage) and Change what is collected (collector.policy).
How this relates to transports
Section titled “How this relates to transports”Change control governs changes made in place in an environment. Transports move changes between environments of a project, such as from staging to production, including an environment’s enforcement-policy overrides. A transport has its own four-eyes step: a second person with Approve and release transports approves it before it is released.
The two share the freeze. A change freeze in force also stops transport releases and rollbacks.