---
title: "Deploy Policy Changes"
url: "https://docs.caracal.run/v1.0/operations/policy-deployment/"
markdown_url: "https://docs.caracal.run/markdown/v1.0/operations/policy-deployment.md"
description: "Validate, activate, verify, and recover policy changes through product-management surfaces."
page_type: "workflow"
concepts: []
requires: []
---

# Deploy Policy Changes

Canonical URL: https://docs.caracal.run/v1.0/operations/policy-deployment/
Markdown URL: https://docs.caracal.run/markdown/v1.0/operations/policy-deployment.md
Description: Validate, activate, verify, and recover policy changes through product-management surfaces.
Page type: workflow
Concepts: none
Requires: none

---

Use web console, Admin SDK, or API. Runtime CLI does not manage policy.

## Prerequisites

Record active version, allow/deny cases, Resources/scopes, Grants, Approval behavior, rollback version, and STS/Audit readiness.

## Procedure

1. Create version and compile merged bundle.
2. Simulate allow, deny, missing-scope, revoked-Session, and Approval cases.
3. Activate in a test zone/cohort.
4. Poll activation status until `propagation_status` is `loaded` and STS version matches.
5. Run canaries and inspect audit.
6. Expand only after pass.

Allow the configured STS poll interval for multi-replica convergence.

## Verify

Canaries match simulation, STS reports intended bundle, no compile/staleness alert fires, Gateway matches, and audit identifies determining policy.

## Rollback or Recovery

Activate the last known-good version and repeat convergence/canaries. Do not edit stored versions or weaken unrelated grants.

## Next Step

Use [Upgrade Caracal](/v1.0/operations/upgrade/) only for runtime/chart/schema changes.