Skip to main content
Every change to a policy’s definition is recorded as an immutable version. You get a full history per policy, a diff between any two versions, and one-click rollback. Nothing is overwritten in place, so you can always see what a policy enforced at any point and restore it.

​
What a version captures

A version is a snapshot of what the policy enforces: its name, description, type, scope, priority, active state, and its full rule set. Assignments (which agents, wallets, or cards a policy applies to) are tracked separately and are not part of a version. A new version is appended automatically whenever you:
  • Create a policy (version 1).
  • Change its metadata (name, description, priority, scope, or active state).
  • Add, edit, replace, or remove any rule.
  • Roll back to an earlier version (the rollback itself is recorded as a new version).
Versions are numbered per policy, starting at 1 and increasing by one. The counter never skips or reuses a number, even under simultaneous edits.

​
List the history

Returns versions newest first, each with its changeType, who made the change, when, and a rule count. Use limit and offset to page.

​
Read one version

Returns the full snapshot for that version, including every rule.

​
Compare two versions

The diff reports metadata fields that changed and the rules that were added or removed. Rules are compared by content, so a rule that only moved position is not reported as a change, and an edited rule shows up as one removed plus one added.

​
Roll back

Rollback restores the policy’s definition and rules from the target version and appends a new ROLLED_BACK version. The policy type is fixed for the life of a policy and is never changed by a rollback.
Rollback is a change to a live control, so it runs through the same governance approval workflow as any other policy edit when your organization requires it. See Governance approvals. If the target version is organization-scoped but the policy currently has assignments, rollback is refused until you remove the assignments, because organization policies apply automatically and cannot be assigned.

​
Audit trail

Version history is a convenience layer for reviewing and restoring policy state. It is separate from the tamper-evident audit log, which independently records every policy change in a per-organization hash chain. See Advanced policies and the audit integrity section on the security page.