8.12 Validation at Publish & Sign
The drawer catches most problems. The server checks everything again when you publish and rejects the policy with a list of errors if:
- a label has no ID, a duplicate ID, or an ID that equals another label’s former ID;
- a name is empty, or two labels have the same name (the console also blocks this with the name issue badge);
- an
ordervalue is missing, below 1, or duplicated; - a colour is not
#RRGGBB(label, sub-sensitivity, marking, email marking or print trace colour); - a font size is outside 6–96 (markings) or 6–12 (print trace), or a placement value is unknown;
- a sub-sensitivity has no name or a duplicate ID;
- a group reference points at a group that does not exist (the console removes such references from labels before publishing);
- a recipient exception is not a domain or an address;
- a group exception is duplicated or can never apply;
- a foreign-label mapping is incomplete, duplicated or uses a reserved property name.
Each publish writes a Policy published audit record with lines such as Label added: Restricted, Label edited: Confidential, Label deleted: Draft and Label migration settings changed.