> ## Documentation Index
> Fetch the complete documentation index at: https://docs.promptguard.co/llms.txt
> Use this file to discover all available pages before exploring further.

# When a Policy Change Takes Effect

> A change you save applies to the next scan PromptGuard makes, and reaches every Shadow AI device within about a minute.

> [!NOTE]
>
> **Within about a minute, everywhere.** When you save a policy, a rule, a guardrail setting or a Suppression, PromptGuard uses it for the very next scan it makes. A Shadow AI device can keep reusing a verdict it already received for an identical request for up to 60 seconds. Nothing learns or adapts in the background, so there is nothing to wait for beyond that.

## What happens when you save

PromptGuard does not compile your policies into something that has to be rolled out. Every scan builds its decision from your project's current policies, rules, guardrail settings and Suppressions. So a saved change applies to the next request.

Two short caches sit in the path. Neither one can hold a change back for long:

| Cache | Where | What it keeps | How long | Can it hide a change? |
| - | - | - | - | - |
| Verdict cache | PromptGuard service | Only **allowed** verdicts, keyed on the exact text **and on your project's current configuration** | 30 seconds | No. Saving a change changes the key, so the next scan is evaluated fresh. |
| Device cache | Shadow AI desktop agent | Every verdict, keyed on the exact request it sent | 60 seconds | For an identical request only. Something already allowed, or already blocked, in the last minute gets the same answer until the minute is up. |

The device cache exists because AI apps resend the same content many times a second, such as their tool definitions. It stops one prompt turning into dozens of identical scans.

## What that means in practice

* **You loosen a policy that was blocking something.** The next new request is allowed straight away. Re-sending the exact request that was just blocked, from the same device, can be blocked again for up to a minute.
* **You tighten a policy.** New requests are checked against it straight away. A request identical to one allowed in the last minute on that device can be allowed once more until its minute is up.
* **You change a guardrail threshold, add a custom rule, or add a Suppression.** All of these work the same way.
* **You edit policies through the API or as code** (see [Policy-as-Code](/security/policy-as-code)). They work the same way: the change applies when it is saved.

## Testing a change

To see a change take effect immediately, send a request that differs from the last one, even by a word. A request PromptGuard has not seen before is never answered from a cache.

## Self-hosted installs

* **Hybrid:** the engine pulls your policies from the cloud once a minute, so a change you save in the dashboard reaches it within about a minute, and then devices within one more. If the cloud can't be reached, it keeps enforcing the last policies it pulled. See [Deployment modes](/shadow-ai/deployment-modes).
* **Air-gapped:** the engine never calls us. Policies arrive in a signed bundle you import, and apply as soon as it is imported.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.