Policies
You read the policy in force in the platform scope: which role grants which permission key, and which settings cannot be loosened in narrower scopes.
What's on this screen
- Permission rules: every policy line coming from roles assigned on the platform; risk class, published or draft status, and the keys it grants. Keys tied to a condition are marked (conditional).
- Floors: settings a narrower scope (Account, Tenant) cannot loosen, and in which direction they may be changed.
- In the side panel: Deny line, Where it comes from and, if any, Reported gaps.
What it means
| What you see | Meaning |
|---|---|
| draft — authorizes nothing | The role is defined but not published; it grants no permission to whoever holds it. |
| can only be raised / lowered | In a narrower scope the floor value can change only in that direction. |
| cannot be changed | A narrower scope cannot change the value. |
| no exemption | There is no exception path for a request to loosen it. |
| Explicit deny rule count: 0 | No explicit deny rule has been written on the platform. An access being refused comes from no permission rule matching. |
Tip A deny count of zero is not a loading error; today the product works with allow rules only.
If you want to change it
This screen is read-only. The keys a role grants are edited in the role studio; a floor's value is written through configuration, and a write that loosens it is refused when it is saved.
Keep in mind Viewing requires policy.read on the platform. No write permission is asked for on this screen, because there is no writing.