Managing policies

In a computing environment, a system, comprising:

• a staging store operable to provide access to a staging policy, the staging store associated with rights that allow a configuration entity to read staging policies from and write staging policies to the staging store, the staging store operable to provide access to one or more policies that are not allowed to be applied until the one or more policies are stored on a production store;
• the production store operable to provide access to a production policy, the production store associated with a right that disallows the configuration entity from writing to the production store;
• and
• a policy manager operable to derive the production policy from the staging policy and to store the production policy to the production store, the policy manager having at least write access to the production store.

A computer storage medium having computer-executable instructions, which when executed perform actions, comprising:

• granting a first set of rights to a configuration entity, the rights including a right that allows the configuration entity to read a staging policy from a staging store, and a right that allows the configuration entity to write the staging policy to the staging store from the production store, the rights not including a right that allows the configuration entity to write the production policy to the production store, the staging store operable to store one or more policies that are not allowed to be applied until the one or more policies are stored on the production store;
• granting a second set of rights to a policy manager, the rights including a right that allows the policy manager to read the staging policy from the staging store and a right that allows the policy manager to write the production policy to the production store;
• receiving a request from the policy manager to store the production policy on the production store;
• and
• in response to receiving the request, storing the production policy on the production store.