Aspects of the subject matter described herein relate to managing policies. In aspects, a staging store is used to store policies that are not applied to a computer system unless and until they are copied to or otherwise imported into a production store. A configuration entity is allowed read/write access to the staging store, but is not allowed write access to the production store. A policy manager is granted read access to the staging store and write access to the production store. The policy manager may approve or deny staging policies. If the policy manger approves a staging policy, the policy manager may derive a production policy from the staging policy and store the production policy in the production store. Once a policy is in the production store, the policy may be applied to one or more entities as appropriate.