Policy Structure and Publishing
An Oct 19 session with our security advisor changed how policies work, and we had one day to see if the new idea held together.
The new model ran end to end in the lab within a day: one policy page holds the switch and every exception. Ten of eleven questions were answered Wednesday morning.
Documents
With file names, on their own page →What changed
The three changes that matter most, in plain words. Open any one to see it.
- 1
Each rule now has its own off, watch or block switch, right at the top of its page.
The switch moves onto the policy · came from Mark Peterson and Mark Parsonopen →
- 2
Groups of rules are no longer built by hand; a team's page simply shows what applies to it.
Groups stop being a thing to manage · came from Mark Peterson and Mark Parsonopen →
- 3
A problem the system flags is now closed by picking a reason, not by blocking or ignoring it.
Findings resolve with a reason · came from Mark Petersonopen →
- Changes went live through drafts with approval for two days, before the team chose one shared draft instead. New in this cycle
- The open questions became an eleven-stop walk, and ten were answered before the next session. In words
How we got here
Each change, traced back to the conversation it came from. A solid mark means the record names the source; a dashed one was matched by the draft and waits for review.
“I just can't accommodate it right now. Like, I can't. It's too noisy and or like, I I can't enforce it at the moment.”
market-analyst /calls/154b2679… (local)“Snoozing, not yet. Not polluting the stream...”
market-analyst /calls/154b2679… (local)c118-D2 Each policy has a mode: Off, Observe or Enforce. — Mark Parson
c118-D3 Exceptions are the only way to vary a policy, by organization, team or person, and the narrowest one wins. — Mark Parson
Each rule now has its own off, watch or block switch, right at the top of its page.
“What I really like about this is it now is all contained within a policy... instead of sprawling across, you know, several objects.”
market-analyst /calls/154b2679… (local)c118-D4 Policy groups are derived, not stored, and show under the team. — Mark Parson
Groups of rules are no longer built by hand; a team's page simply shows what applies to it.
“We have, like, open and then resolved for whatever reason or ignored for whatever reason.”
market-analyst /calls/154b2679… (local)c118-D5 Block leaves findings; Resolve takes a reason: false positive, by design, security testing or other. — Mark Parson
A problem the system flags is now closed by picking a reason, not by blocking or ignoring it.
Thanks to
People outside Qpoint first. Every thank-you points at something they said or made.
Put everything about a rule on the rule
On Oct 19 he moved the off / observe / enforce switch onto the policy, asked for findings to close with a reason instead of Block or Ignore, and pointed out that suppressed findings shouldn't pollute the stream. That afternoon on Oct 21 he called Snooze "not a thing anymore".
“I just can't accommodate it right now. Like, I can't. It's too noisy and or like, I I can't enforce it at the moment.” first-hand
Named conflict handling as the hardest problem
Called change-set conflicts the hardest thing on the roadmap, which is why publishing kept being simplified.
“Of all the things that we're doing, this is the hardest, like, without question.” internal
Turned the session into a working lab in a day
Proposed groups as a derived view rather than an object, built the Oct 19 model into the lab, and ruled ten of the eleven Wednesday questions on the walk.
All images
Every picture from this cycle. Click any one to step through them all.
The pairs
Everything captured · 7
The full record 0 decisions · 5 key-change entries · 1,331 words · 0 captures
The record stays as written, for agents and for audit: Key Changes, every decision, the artifacts and the visual record.
Open the record for c118 →