System-wide and Organization-specific Policy Enforcement

The Organization properties specify the organization to which the policy applies. When the Apply policy to all organizations option is enabled, it indicates that the policy is system-wide. When the Apply Policy to Organization property specifies a particular organization, it indicates that the policy is organization-specific.

A system-wide policy is enforced for all organizations. For example, if you create a system-wide policy that executes when an asset of Virtual Service type is published to gateways, CentraSite enforces the policy whenever any user in any organization publishes an asset of the Virtual Service type is published to the gateways.

To create a system-wide policy, you must belong to a role that has Manage System-Wide Design/Change-Time Policies permission. In a standard CentraSite configuration, only users in the CentraSite Administrator role and the Policy Administrator role have this permission.

System-wide policies are useful for managing many instances. However, organization-specific policies are often better choices for asset-related policies, because they enable an organization to tailor its policies to its own development processes and methodologies.

An organization-specific policy is enforced on assets that belong to the same organization as the organization to which the policy applies. For example, if you have a policy that executes when assets of Virtual Service type are published to gateways, and its Apply Policy to Organization property specifies organization ABC, CentraSite only executes that policy when asset instances of the Virtual Service type in organization ABC are published to the gateways.

Points to keep in mind when working with organization-specific policies:

You can create organization-specific policies for any organization on which you have Manage Design/Change-Time Policies permission. For example, if have you Manage Design/Change-Time Policies permission for organization ABC and XYZ, you can create organization-specific policies for either organization.

You set the Apply Policy to Organization property when you create a policy. After a policy is created, you cannot change this property.

At enforcement time, CentraSite selects policies based on the organization to which the object belongs, not the organization to which the requestor belongs. For example, if a user from organization XYZ edits an asset in organization ABC, CentraSite applies organization ABC's policies (the organization to which the asset belongs), not organization XYZ's policies (the organization to which the requestor belongs).