Multi-Environment Promotion
Define a promotion chain (dev → staging → prod) in entity environment config.
Rules
- Never skip environments for regulated workloads without explicit exception
- Compare bundle versions across environments before promote
- Use EnforceAuth deployment history as source of truth for "what is live"
Drift
If PDP pulls an old bundle URL, decision logs may not match console — verify bundle destination after infra changes.