Rudder

forgot this:

... but my concern was mostly making it safe for the change validator that he'll find all pieces that are related

The full idea would be:

- when doing a modification on a group/directive/change, have to possibility to add it to an existing "work in progress" (or draft) change request
- at any time, have the possibility to freeze a draft and propose it as a change request including all the unit modification (ex: Modify Directive 1 applied to R1, add Directive 2 to R1, add a restriction group to R1, delete R2)
- that change request is seen as only one item by the validator, with all the modification (and all the diff) accessible from the validation screen
- it accepts or reject it globally, so that either all the modification or none are commited (and if it be so, that only policies with all the modification are propogated to nodes)

What I don't know for sure is if in your scenario, all the modification would be created by only one people or by several. In the second case, the story need a coordination possibility, either by grouping change request in one aggregate (but in that case, it may be the whole solution) or if draft change request should be clonable/sharable between users.

I think it's likely there will be multiple people involved.

Possible interactions to toy around with:

x Team A does their bit of a change, Team B is, in the same change working / updating another piece
I.e. think renaming a web server, will easily be a little bit to adjust here and there.
x Alice on Team A is working on something. He is interrupted, and Bob needs to take it over. John will be validating it.
x Fred is working on something, normally he just adds predefined directives. he finds a policy issue and Alice takes over. She's the team lead, hates her bug and selfvalidates everything after fixing it so noone notices. (but the audit log will :)

I think it would be easiest by sharing and having the option for a global identifier.
you mentioned "draft" and a draft state might be a helpful piece in this.

"- that change request is seen as only one item by the validator, with all the modification (and all the diff) accessible from the validation screen"

I think it should be possible for him to decline a single bullshit piece out of it. So, group yes, select all pieces, but it might not be be needed to treat it as one thing.

(my head will explode if we keep going around this a few more times. But that's fine :)

Thanks for all the precision, that make for a really nice user story. I can't commit any deadline for it because it seems to have quite some dev to play with, but the (imagined) result looks like something helpful for people and usable (the risk with such things being that it's so complicated or unflexible that nobody want to use it).