Skip to main content
A rollback does not delete a revision. It makes a new policy change that takes values from an old revision, and its publish makes a new revision with a higher number. The history stays complete.
This guide needs the SafeDep Cloud Team or Enterprise plan and the Admin role. See pricing.

​
Find the revision to restore

The list shows each revision, who published it, its change direction and its message. To read the settings of one revision:

​
Create the rollback change

Restore one capability, such as scan_gate:
  • --capability names a capability to restore: scan_gate or package_admission. Give it more than once for more capabilities. Without it, the change restores every capability.
  • For each restored capability, the policy base and every policy override take their values from revision 46. A policy override that did not exist then loses the fields of the restored capabilities.
  • Package rules stay as they are now. To restore the set of package rules of revision 46 as well, add --package-rules revision. The change then deletes the rules that came after revision 46, and creates again the rules that were removed after it, with new rule ids. A rule whose expiry at revision 46 is now in the past does not come back. The restore never keeps more package rules than the old revision had.
The command prints the number of the new change and its change direction.

​
Preview and publish

Use the change number that the create command printed. The preview warns when the rollback drops fields of a policy override. A rollback that loosens the policy asks you to confirm it. Every Owner and Admin of the tenant gets an email about the rollback, also when it tightens the policy.

​
Undo one package rule

To undo one block or trust entry, you do not need a rollback. Delete the rule:

​
Next steps

Policy Revisions and Changes

Revisions, change direction and stale changes.

Audit Policy Changes

Find the publish that you want to undo.