Declarative full-replace apply. entries is the complete desired content of the policy set: any policy omitted from entries is dropped from the resulting version (its rows are retained and a later apply may reference it again). Entry order is preserved for newly added policies; retained policies keep their current manifest order, so an unchanged apply is byte-identical and dedups to the existing version.

Per entry, the server diffs by content SHA against the version pinned in the latest manifest: unchanged content under the same schema version reuses the pinned policy version; changed content mints a new policy version; new_policy entries mint a customer-owned policy with the requested name. All of this, plus the policy set version mint and the optional activation, happens in one transaction (row lock on the policy set). Cedar validation runs against the resolved schema before the transaction opens — an invalid policy rejects the whole apply with zero writes.

Schema resolution: schema_version omitted → the latest version's schema if still writable, else the zone default. Provided → authoritative (schema_version_unsupported if unknown, unattested, or archived). All entries validate against the single resolved version (uniform-schema-per-version is retained); a pinned policy version created under a different schema is re-versioned even if its content is unchanged.

Activation: activate: true requires a zone-targeted set and rebinds the (zone, target_type=zone, mode=active) slot to the resulting version in the same transaction. It requires policy_set_bindings:activate permission and preserves the previous binding in binding history. Unchanged content returns created: false and still activates the resulting version. An already active version keeps its binding unchanged.

Concurrency: If-Match is optional (omitted = last-writer-wins). When provided it is compared, under the row lock, against the digest of the latest version's manifest; mismatch returns 412 (etag_mismatch) carrying the current ETag. The token is content-addressed, not a version identity: it guards "the content I read is still the content in place", so two versions with identical manifests are interchangeable for the precondition, and archiving the tip does not invalidate a token whose digest the new latest version still carries. Do not re-key it on policy_set_version_id.

Identity and reverts: a desired state identical to the latest version is a no-op (created: false, latest returned, nothing minted). A desired state matching an older version mints a new version at the tip — history is linear, never forked. Rolling back deployment without a content edit is not an apply at all: bind the older version via PUT /policy-bindings.

Authorization: the route gate is update on the policy set. When activate: true, the handler additionally requires the activate action on policy_set_bindings.

Domain error codes: policy_set_not_found, policy_not_found, policy_version_not_found, version_archived, schema_version_mismatch, manifest_duplicate_policy, missing_cedar_content, invalid_cedar, schema_version_unsupported, policy_name_conflict, policy_archived, set_archived, etag_mismatch, activate_requires_zone_target, shadow_equals_active.