SkieWhat is a signed policy bundle and why does it matter?
A signed policy bundle is the set of rules sent to a device, with a cryptographic signature the device checks before applying anything. If the signature does not verify, the device rejects the bundle. This stops forged or altered rules from taking effect.
When an admin changes a rule, the dashboard builds a policy bundle for the devices in scope. A bundle carries the filter choice, the allowed apps, the schedules and the hardening switches. Before any of that is applied, the device checks the signature.
A cryptographic signature is a proof that the content came from the right source and has not been changed since. If someone intercepted a bundle and changed an allowed app, or invented one from scratch, the signature would fail and the device would ignore it. The device keeps enforcing the rules it already had.
This matters because of where rules travel. Devices sync over the internet, often on networks you do not control. Encryption protects the connection, and signing protects the content itself, so even a trusted-looking message from the wrong source does nothing.
As an admin you see none of this work. You edit a policy, check the impact preview, and apply. After the apply, the device reads each protection back from Android and reports a compliance score, so you can see that the signed rules took effect.
Practical tip: if a device reports that it is not on the latest policy, check its connection and battery before suspecting anything else. A device that cannot sync stays on the last verified policy, and the breach centre will show how long it has been that way.