Simulate a policy before activating it (candidate and test decision)

For risky changes, evaluate the new revision next to the active one before giving it effect.

Step 1: create without activating

In «New revision», choose «Create only, for shadow evaluation» and approve. The revision exists but decides nothing.

Step 2: stage the candidate

On the revision, choose «Prepare candidate» and approve. It moves to «Candidate / shadow»: «The candidate will be evaluated in parallel only for comparative evidence. It does not allow, deny or require factors in any operation.» The server records the comparison between the active and the candidate revisions.

Step 3: test decisions

1. Open «Test decision».
2. Edit the synthetic JSON context: who asks, which action, which resource, which authentication method, which network zone, what time.
3. Choose «Run simulation». You see the decision, the «Reasons» and the «Matching rules».

The result is marked «Advisory only»: «Advisory result; it does not issue authority or change the rollout.» The simulation creates no authorization and is not audited.

Test at least one passkey context, one phone-approval context and one case that should be refused.

Step 4: promote

When you are confident, choose «Promote candidate» and approve. The candidate becomes «Active / applied» and the previous one «Previous / rollback». «Promotion is always a separate, confirmed action.»

Going back

• «Roll back active» returns to the previous revision. «Rollback only becomes available after a promotion.»
• «Clear shadow» removes the candidate without activating it.

Why did the transition fail?

«Each transition uses the state version shown and fails if another administrator changes the rollout in the meantime.» Refresh and try again.