provision-policy
Publish pending draft policy changes to active state in Illumio PCE. Promote specified draft rulesets, rules, IP lists, services, and label groups, or apply all pending changes at once.
Instructions
Provision pending draft policy changes in the PCE. This moves draft rulesets, rules, IP lists, services, and label groups from draft to active state. You can provision all pending changes or specific items by href. WRITE OPERATION: changes PCE state. In clients that gate tool calls (Claude Desktop, Claude Code), this pauses for the user to approve it -- the call has not failed and must not be retried while waiting. Additionally requires an explicit confirm token, so it takes two steps: the first call returns a token to be passed back in the second.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hrefs | No | List of specific draft hrefs to provision (e.g., ['/orgs/1/sec_policy/draft/rule_sets/123']). If omitted, provisions ALL pending changes. | |
| change_description | No | Description of the provisioning change (for audit trail) |