The Policy Is Edited Whole or One Rule at a Time Under One Lock

Context

The API retains individual-rule maintenance while the console stages one complete policy. Both paths must coordinate without silently losing coverage edits.

Decision

Individual changes increment settings version and generation. Full saves check settings version when supplied and replace the complete rule list, retaining submitted identifiers. Initialization races and reset rule versions remain gaps.

Alternatives Considered

Keep only complete-policy replacement. The recorded earlier choice introduced individual-rule maintenance, and clients may depend on that surface.

Keep only individual-rule updates. The approved console experience stages a complete policy and saves it in one request.

Update retained rules in place and increment their versions. This remains the recommended unresolved option rather than an adopted implementation decision.

Consequences

A versioned full-policy save conflicts after a newer individual-rule write. Resetting retained rules to version one can admit an older individual edit. A full editor save must include every rule intended to remain.