# Protecting policy

An agent can edit policy, but the change can't ship without a person's
approval, wherever it is written. The compiler compares the whole
application before and after, because access also widens when an output
gains a field, a route becomes public or an action starts touching another
entity.

Each widening needs an acceptance: a file in `acceptances/` in which a
person accepts that change
([Acceptances](acceptances.md)). Breaking API
changes and database drops are accepted the same way.

Schedules and subscribers act as the system
([Background work](background-work.md)), and what `Access.system` is granted
shows in the permissions report. The compiler's own purge of soft-deleted
records ([The purge schedule](schedules.md#the-purge-schedule)) is
the only operation outside policy.

Acceptances for a change that widens access aren't built yet
([What is built](policy-built.md)).