Policy deployment delivers authorization policies from managed repositories to the policy administration point (PAP) and onward to policy decision points (PDPs), where they become operational. Externalizing policies from application code supports reliable updates while preserving precise, real-time authorization decisions. section 10.0 section 14.2.3
A governed deployment flow connects policy change to production use:
- Create and review the policy, recording its rationale in an architectural decision record (ADR). section 14.2
- Store policies in version control so changes, authorship, peer approval, and retirement remain traceable. section 14.2
- Use continuous integration and delivery (CI/CD) pipelines to lint, validate, test, and deploy approved policies. section 14.2
- Publish the approved version to the PAP, distribute it to PDPs, and verify behavior under real workloads. section 14.2.3
ACME production deployment
ACME keeps authorization policies in repositories alongside configuration and service definitions. After approval, its pipeline tests a policy change, publishes the version to the PAP, and distributes it to PDPs enforcing access across collaboration and production systems. section 10.0 section 14.2.3
Figure 14.2 The policy management life cycle. Policies go through distinct stages (creation, review and approval, deployment and use, monitoring, and eventually retirement) with updates feeding back into the review process. The life cycle ensures that authorization policies remain current, coherent, and aligned with organizational intent.
The life-cycle diagram connects creation, approval, deployment and use, monitoring, retirement, and feedback into a continuous governance loop. section 14.2
