---
id: SCR-PFM-SEC-012
title: Edit policy
route: /console/{tenantId}/security/policies/{policyRef}/edit
surface: console
product_area: platform
module: security
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
purpose: Edit an active custom policy with its loaded version and validated rules.
supports:
- JNY-PFM-SEC-004
- CAP-PFM-SEC-012
permission: platform.security-policies.read (SecurityPage view guard; editor additionally requires management
  authority and redirects when absent)
entry_from:
- /console/{tenantId}/security/policies/{policyRef}
exits_to:
- /console/{tenantId}/security/policies/{policyRef}
displays:
- field: Loaded policy rule content and record version.
  source: getSecurityPolicy
  provenance: observed
- field: Save-result impact feedback for affected members and assignments.
  source: patchSecurityPolicy response
  provenance: observed
actions:
- label: Validate rules during save
  operation_id: validateSecurityPolicyRules
  permission: platform.security-policies.read
  confirm: false
  provenance: observed
  source: react-console:components/security/policies/policy-edit-screen.tsx
- label: Save
  operation_id: patchSecurityPolicy
  permission: platform.security-policies.manage
  confirm: false
  provenance: observed
  source: react-console:components/security/policies/policy-edit-screen.tsx
states:
- loading
- error
validation:
- BR-CAP-PFM-SEC-012-10
- BR-CAP-PFM-SEC-012-12
- BR-CAP-PFM-SEC-012-13
patterns:
- SecurityPage guard
- EditorActionBar
- RulesEditor
- BasicInfoFields
component: components/security/policies/policy-edit-screen.tsx (PolicyEditScreen, edit mode)
evidence:
- 'react-console at baf6dae: components/security/policies/policy-edit-screen.tsx; the page route file; lib/security/api.ts,
  lib/hq/platform-ops.ts, lib/hq/platform.ts, lib/auth/*'
- react-console:components/security/page-shell.tsx:SecurityPage; lib/authz/backend-aliases.ts (Security aliases)
console_area_permission: security.access
examined_at: '2026-10-23'
examiner: codex
controls: [TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-003, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Edit policy

## What the Screen Is For

Edit an active custom policy with its loaded version and validated rules.

## What It Shows and Lets People Do

The route guards policy reading. The editor redirects built-ins or callers without management authority to view; it does not render a read-only editing mode.

## States and Errors

Save validates locally and through the rule-validation operation, then patches the policy with its loaded version. Widening, lockout and stale responses remain editable errors. Impact feedback comes from the returned change result.

The state rows describe observed loading, empty, refusal or inactive handling where present. Linked validation rules belong to the planning layer; client feedback and authoritative service checks have distinct responsibilities.

## Patterns It Must Respect

The pattern list names the built shared components and interaction patterns checked for this screen. This contract describes the existing screen; it supplies no replacement visual design.