Governance Policy groups

Policy groups

A policy group collects policies of one type under a single On or Off switch. Turning a group Off pauses every policy in it. Turning it On runs them again, each as it was set. Groups also fix the reading order of the list.

There are two kinds:

Your own groups. You make them, name them and choose their policies.
Provided by Oxelone. Oxelone maintains the group and the policies in it. You cannot edit them, but you can switch, reorder, duplicate or remove them.

Groups are on the Network, Host and Hook tabs of Governance › Policies. A group holds one type of policy, and a policy is in one group at most. A connector's rules are listed in a group per connector under From connections; they have no group switch, because each connection switches its own rules.

Open Policies

Who can do it

You want to	Permission
See groups	`policies:read` (View policies)
Create, edit, delete, reorder, switch, remove or restore a group	`policies:write` (Edit policies)
Switch on, restore or delete an Off group that holds an Enabled policy	`policies:publish` (Enable policies) as well, because those policies start enforcing again

Owner, Admin and Policy author hold policies:write and policies:publish. Analyst and Compliance reader can read policies only.

Make a group of your own

On the tab for the policy type, choose New group.
In Name, type a name (up to 120 characters).
Optionally fill Description (up to 500 characters).
Under Policies, tick the policies to include. Only your own policies that are in no other group are listed. If there are none, the list says "Every policy of yours on this tab is in a group already."
Choose Create group.

A new group is On. To change it later, open its ⋯ menu and choose Edit group.

Switch, set and order a group

Each group header shows its name, a Provided by Oxelone badge when it is one, and a count. An On group reads like "6 of 8 running". An Off group reads like "Off · 4 kept as set". The ⋯ menu has:

Item	What it does
Expand / Collapse	Opens or closes the group.
Turn group on / Turn group off	Switches the group.
Set every policy in it to	Sets all its policies to Enabled, Monitor or Disabled.
Move up / Move down	Changes the group's place in the list. Reordering changes nothing that runs.
Edit group, Delete group	Your own groups only.
Duplicate to edit, Remove from this workspace	Provided groups only.

A policy in an Off group shows the state Group off, and its own state control is locked with "Runs again when the group is on." It keeps the state it had.

Deleting your own group leaves its policies in place, each with its own state, in no group: "Its policies stay, each with its own state, in no group." If the group was Off, its policies start running again.

Provided groups

Duplicate to edit copies each policy of a provided group into a new group of yours, Disabled, named with "(copy)" after it. Edit the copies and turn them on.

Remove and restore

Remove from this workspace takes a provided group and its policies out of your list. They stop running here and stay available to others. Confirm with Remove: "The group and its policies leave this workspace's list and stop running here. They stay available, and you can restore them from the removed list below the table."

You can remove a single provided policy the same way, with Remove from this workspace in its row's menu.

To bring them back, open Removed vendor policies below the table and choose Restore on the group or the policy. Everything returns with the state it had. If that includes an Enabled policy, you need policies:publish.

When it goes wrong

You see	Why
Could not create the group	The create was refused; the reason follows.
Could not save the group	The edit was refused.
Could not delete the group	The delete was refused.
Could not remove the group	The removal was refused.
Could not duplicate the group	The copy was refused.
Could not restore this group	The restore was refused.
Could not restore this policy	The restore was refused.
a group needs a name	Name is blank.
policy `…` is already in another group; a policy is in one group at most	A policy you ticked is in a different group.
policy `…` is of another type, and a group holds one type	A policy of another type was included.
policy `…` is provided by Oxelone and stays in its provided group; duplicate it to get a copy this organisation can group	You tried to group a provided policy.
this group is provided by Oxelone; its name and policies cannot be edited here — duplicate its policies to get copies this organisation owns	You tried to edit a provided group.
a connector's rules are switched on each connection, not by their group — use Policies › From connections or the connection's Rules tab	You tried to switch or remove a connector group.

With the API

Groups are in the Policies reference under /policy-groups. Removing a provided policy is DELETE /policies/{id}, and POST /policies/{id}/restore brings it back.