Skip to main content
This page lists the limits that SafeDep Cloud enforces on the cloud policy of a tenant, how long it keeps policy data, and the gaps of this release.

​
Limits

A write over a limit fails with RESOURCE_EXHAUSTED, and the error names the limit. For the length of the other fields, see Cloud Policy Settings.

​
Roles

​
Retention

​
What a holder of the tenant API key can read

The tenant API key can call only the data plane. It cannot read or change the policy settings document, the revisions or the audit events. It can fetch the resolved policy of an endpoint. Until endpoint enrollment ships, an endpoint asserts its own identity and its managed/ and reported/ labels. So a holder of the key can fetch the resolved policy that matches another endpoint or other labels. Treat each policy override and the reason of each package rule as readable by every holder of the key. The ticket and the requester of a package rule are not in the resolved policy. Do not put a secret in a reason, a ticket, a requester or a description. A holder of the key can also report an applied policy revision for any endpoint. So the applied revision of an endpoint is a record of what the endpoint reported, not proof. The policy revisions prove which policy SafeDep Cloud served.

​
Known gaps

These gaps are accepted in this release:
  • PMG keeps its policy cache in the folder of the user. A user can change the cache on a laptop. The same user can also remove PMG.
  • IT can keep a value from the cloud policy only with the PMG global_lockdown setting, which keeps every key that the managed config file sets. IT cannot lock one field of the policy alone.
  • No endpoint label is an access boundary: an endpoint can claim the identity of another endpoint and get the policy overrides of that endpoint.
  • PMG fetches the policy in the background after a command, at most once every 5 minutes. The first install after a new block can use the previous policy.
  • Vet does not read the cloud policy. The pull request check does not apply the dependency cooldown, and reports a malware verdict that is not verified without failing on it.

Cloud Policy Settings

Each setting and each field of a package rule.

Labels

Which labels you can trust.