2.3 How a policy reaches users

1. An administrator edits labels, groups and rules in the console. Changes go into a draft.
2. Publish & Sign validates the draft and signs it. Every published policy gets a version (a timestamp).
3. The server builds a separate signed policy for every group. Each machine downloads the policy for its own group at the next sync (default every 5 minutes; see section 10.6).
4. Agents verify the signature with a key they received at install time. An unsigned or tampered policy is rejected.
5. Agents enforce locally. If the server is unreachable, they keep enforcing the last policy they verified and queue audit records until the server is back.

Settings under Administration → Settings are different: they are server settings, saved immediately and not part of the signed policy.