LEARN. PRACTICE. GROW.Concept and mechanism
An approval should correspond to the diff being merged. If commits arrive after review, configure an appropriate policy to reset approvals or require review of the latest iteration. In Azure Repos, path filters also bound control: a rule for /app does not necessarily cover /infra. Include IaC and pipeline definitions in review by people capable of assessing their impact. Check bypass permissions: completing a PR despite policies and pushing directly are distinct permissions. A failed policy visible in the UI does not prove it blocked an identity permitted to bypass it. Use bounded, auditable exceptions.
Guided application
To reverse an already shared ordinary commit without rewriting history, git revert creates a new inverse change. Review and test that change; do not assume it removes effects already produced outside the repository. If a valid secret was published, prioritize revocation or rotation and exposure assessment. Deleting the current file neither removes every copy nor invalidates the token. History cleanup requires coordination and does not replace revocation. For large binary files, Git LFS retains Git pointers and separate objects; the pipeline needs access to both. When closing an emergency hotfix, record the final diff, validation evidence, and removal of temporary access.
The approved PR received an authorization change. Approval of the previous diff is not evidence of review of the new one.
Common pitfalls
Old approval as permanent; forgotten bypass; deleting a secret as revocation; LFS pointer as binary.
Related topics: Artifacts, dependencies, and agents · YAML, conditions, and approvals
Connect each approval to the final revision and each exception to its closure.
Reference: Branch policies · AZ-400 objectives 2026-07-27