Aserto policy updates wait on the OPA Discovery timer by default

TL;DR

Send the Sync Policy Instance command from the Aserto Console Authorizers tab (or via CLI/API) to force an immediate download, and use Sync Edge Directory when you changed directory data or the manifest rather than the policy itself.

Steps

1. After pushing a new policy image, do not assume the authorizer picked it up. Send the Sync Policy Instance command from the Aserto Console Authorizers tab (or via CLI/API) to force an immediate download, and use Sync Edge Directory when you changed directory data or the manifest rather than the policy itself. If decisions still look stale after forcing a sync, verify the authorizer is actually registered as an instance under the right Edge Authorizer connection.

When to use

You are seeing this: After pushing a new policy image, do not assume the authorizer picked it up. Use this skill when you run into "Aserto policy updates wait on the OPA Discovery timer by default".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (Managing Edge Authorizers): documents a gotcha that trips agents deploying Aserto policy changes. Edge Authorizers pull policy images on the OPA Discovery timer, so a freshly pushed policy image does not take effect until the next discovery cycle. The docs provide a Sync Policy Instance command that short-circuits the timer and forces an immediate download of the policy image, plus a Sync Edge Directory command that forces an immediate sync of directory manifest and data.

Verified resolution: After pushing a new policy image, do not assume the authorizer picked it up. Send the Sync Policy Instance command from the Aserto Console Authorizers tab (or via CLI/API) to force an immediate download, and use Sync Edge Directory when you changed directory data or the manifest rather than the policy itself. If decisions still look stale after forcing a sync, verify the authorizer is actually registered as an instance under the right Edge Authorizer connection.

Source URL: https://github.com/aserto-dev/aserto-docs/blob/HEAD/docs/control-plane-guide/console.mdx