How do you troubleshoot policy conflicts across multiple enforcement points in a large ZTA deployment?

Policy conflicts in large deployments usually stem from drift between what different PEPs believe policy to be, rather than a single logical error in one place, so the troubleshooting approach has to address that root cause, not just symptoms.

1. Centralize the policy source of truth so no PEP is running a locally cached or manually edited copy that can drift from the canonical version.
2. Use policy simulation or dry-run tooling to detect overlapping or contradictory rules, such as one rule implicitly allowing what another explicitly denies, before pushing changes live.
3. Check evaluation order and precedence rules explicitly; an explicit deny elsewhere in the rule set commonly overrides an allow rule that looks correct in isolation.
4. Correlate each PEP's decision logs against the specific policy version it was running at the time, since version-skew during a rollout is a very common source of "it works on this gateway but not that one" reports.
5. Roll out policy changes incrementally with canary PEPs and automated conflict-detection tests, rather than pushing a change fleet-wide and discovering conflicts in production.

Treating policy changes with the same rigor as code deployments, versioned, tested, canaried, is what actually prevents this class of problem rather than repeatedly firefighting it.