---
title: "Stage, preview impacts, and enforce policy"
description: "Stage and preview policies to observe traffic implications before enforcing them."
product: "Calico Enterprise"
version: "3.21"
section: "Network policy"
canonical_url: "https://docs.tigera.io/calico-enterprise/3.21/network-policy/staged-network-policies"
---

# Stage, preview impacts, and enforce policy

## Big picture

Stage and preview impacts on traffic before enforcing policy.

## Value

Calico Enterprise staged network policy resources lets you test the traffic impact of the policy as if it were enforced, but without changing traffic flow. You can also preview the impacts of a staged policy on existing traffic. By verifying that correct flows are allowed and denied before enforcement, you can minimize misconfiguration and potential network disruption.

## Concepts

### About staged policies

The following staged policy resources have the same structure (i.e. the resource spec has the same fields) as their “enforced” counterpart.

- Staged global network policy
- Staged network policy
- Staged Kubernetes network policy

### Review permissions

The default `tigera-network-admin` cluster role has the required permissions to manage the different enforced and staged network policies. Adjust permissions for your environment. As with Calico Enterprise network policy and global network policies, the RBAC for Calico Enterprise staged network policy and staged global network policy is tier-dependent.

## How to

- [Create a policy recommendation](#create-a-policy-recommendation)
- [Stage a policy](#stage-a-policy)
- [Preview policy impact](#preview-policy-impact)
- [Enforce a staged policy](#enforce-a-staged-policy)
- [Stage updates to an enforced policy](#stage-updates-to-an-enforced-policy)

### Create a policy recommendation

One of the first things developers need to do is secure unprotected workloads with network policy. (For example, by default, Kubernetes pods accept traffic from any source.) The **Recommend policy** feature allows developers with minimal experience writing policy to secure workloads.

Because **Recommend policy** looks at historical flow log entries that match your request, you should run your workloads for a reasonable amount of time to get "typical network traffic" for your application.

1. In the left navbar, click **Policies**.
2. Click **Recommend a policy**.
3. Enter time range, Namespace, Name, and click **Recommend**.
4. If relevant flow logs are found within the time range for the workload endpoint, click **Preview** to assess the impact of the recommended policy, or **Stage**.

![recommend-policy](https://docs.tigera.io/assets/images/recommend-policy-61392143274f8323a197cc58822d1515.png)

### Stage a policy

Stage a policy to test it in a near replica of a production environment. A best practice is to stage a policy before enforcing it to avoid unintentionally exposing or blocking other network traffic.

1. In the left navbar, click **Policies**.
2. In a tier, click **Add Policy**.
3. Create your policy and click **Stage** to save and stage it.

![stage-new-policy](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAVEAAABNCAYAAAAfFVcWAAAAAXNSR0IArs4c6QAAFqJJREFUeAHtnQd8VUX2x0+Sl4SEkEIKBEJIIAQIvVelSBUVBaTq3/ZXPxbcdV1dlXUtrCvih3VdFdl1WUXWP2sDRLqCSC+h95ICoQRSgPSElP/5Tbzwcnl5efe9l/Y48/kkeffeuXNnvnfmzDlnzry45eXllpEkISAEhIAQsIuAqaio2K4b5SYhIASEgBAgMmVeviochIAQEAJCwE4CbtnZOWLO2wlPbhMCQkAImNzd3YSCEBACQkAI2EnA3c775DYhIASEgBBgAiJEpRsIASEgBBwgIELUAXhyqxAQAkLAJAiEgBCwTMAr80HLF26xs0WNF95iLTbWXNFEjfGS3EJACAiBCgREiFbAIQdCQAgIAWMERIga4yW5hYAQEAIVCDjsE3VTYaauGmtaRmU2bkVwKwdRAa7hA36YjY8zXLQjN7j2OyZ+x7ZRvxYM36Dr9/WqfMFO6euOdMhqvdf2Ma9VwyEhajK5U3Z2IeUVFGnludRfXx8vauTnTcXFpZW2CwLGw92dLl/NJ/U9BHaOMTcenAH+Dcjby0TFJZU/T6uIrQNfy2/pry2DweThTvmF1ygru8BSEfX7HMtOLy8PCgrwpZLS0ionzPz8a5Sb75p93aeBJ/k3amC1r+Nle3l6UH7BNSq6VlK/330ltceY92S5dq3Y9vbZLUSx02nrziRKv5xPfg29XW5+hm6Sk1NIoSG+1LdHSyopsaytlJSW0bpNxxl6Gfl4e5I9CilKLuNyrmTnU9cOzah1y2CrgrSUBzySLUJQZbTwC0IYP+48AVSWIECPnbpER05cZAHvq9pm5xxR2SNq9TwU0AKeIIBgyIAYglJgTSldt+kUNWJB40oM8ALQ/3LziigwwJsG9Iqu9J14cH9YvPIAffltPF2+kmdXX6+08Fq+oI3uVpEh9Mxjt/E4bG6zILVLiALmiYRLlJ1XTOPv6ubQYK5ldlYfD8H2w9qDdCopnWKiQ1mQVtQQPU0etGVXEnc+PxrYp7XVsmy5mJ1TQMvWHKCwED/CjGhJ24QA9fDwcApzlF9SUmJRkGKSzOCBcuhYKt03phtBU3HVtGN3Mu3ce4Zu69vKqiY27u7ubHW4mgi98VZX/nRITZodA2+c0z55sga6hZWmP81aSddYC/XwcE0Op1Mu09kLV+iLjx6gxkG+VMoyoKpUuRpi5U4APH32Mmto0U4ZzFYeVauX3HjA9OE2oq2YOPQJAu1SRo7ioL9mz3EjvwbUOiqUzp6/YrGTakLVEQ3UvF5aOVq55tfQ3jPc7ri2zVxagKLNvbq1pAy2qPSTpDkPfHZlAYr29e3ZilLOXcbHmxK09I3bTilTHi4Q9A9X/PH18aSkMxnK+oKSZEu6WTLYchcbNBh4AOvqCW381Xq+qanlcxR7M52onXhy57Rl9rupMtVwAvWABuLqCZOJNqG4eluttQ/uG2uKV1FRCXOyVoJrXIMFCm3bVr+NQ1LQmv/INXBi5bZmW1LDj6uycTXd/iorJBmqjUBV7/pWEKAaXCNtdUiIag+Uv9YJYOX3/Xnr6NDR89YzVtPV4uJiZTmItlVNgKVYqwRgtWI1H9Er+KnM0irlfEZWxa0+tAYv1qoQTWbfw7b4RDqfWr3frr+CHeZ79p+pQawVH1XG61HreQX/eMLFihecdIQV9sp+TCYTZWVlUXJyco0JUqz0Hjl+nvYfSqHUS1l2txKLlzP+sowHoOv8C5vTKZm0c0/y9ZCxPGaVxn51V00QoD4NvKh/r1Y0bFB7Gja4PQU3bqiiTyBM4YdGHi3fnDcn0PTHh1AhC1uc066DDx8qAYz7cA0JCorel41zlQlqdZOTf9m1Ou9oHQDgn19soWWr91PTJv5qAWPCPd3p8QcGsDBwU+EWGDj+vNACmF4cO3mN/THFvJKMmM2gQN/rVcCAzc0r5BXtRhXOFXAsG14W0gpeYe/aMYK6d4m8nqemP6ANiCetjpSens4+nGsW/XrQPnNycgh58DkyMtLiarwz67X3QAq99NZi6sG8z/BCxbTxvWncXV2VnwkuNQ/2M8NpjzAZfMZ7zuP4S7z7BhwmhpSTW0je3ia10KZxQ6wqBgjiOtEvMHgQxYAwJSTcixhGd24n7q1raenK/TT/y60qHvMqh7N99sGDtGHrSVq74SjNeXO8Oo+xkZ6Zq/p4YWGxWtQDF/BA3/fjuGVoc2g3UsblXG63iRr6ete15qr64B1FNAuiubMnc6THBcrjsZp5JVe9P7ynAH8fNYlcuZpHY4Z3otHD4mj6K1+zECxlf7wXNQn1p0vp2XxfETXkUEq0G2Xi/eNc83AOJeBOdY5X1FEe+IU3CVB5LqZl8eIXIlmqF02t9DTEVX77wx6az50osnkQxbOWuGHzCaXy/7L1BH00/xcK4Hg8OHfj2jWjSfd0o9+9vphCgxtReka2Cqt6dFp/Wr7mIH3+1TYq4RjNNjFhNPPlu5XG98VX25XAaB/blF7+zUgeUJ68CFbzCyR4+QGNfFSAsvlrhHaGiQCB9Y4mdJrc3FweWEWqzTg2TxCchYWFqnPl5+erzmktNtT8Xns/w3SLbN6YPnxnEi1dtZ8+/+82atmiMb3+7nLV7pmv3E1r1h+hLTsSeCGjlO6/pyf5+XqpcLKPZk0iaGvQQJ/8n4G0Y3cSPTKlL33x9Q5axRYF0h23t6P2seH0n2920CfvTaG3/7paCeE5b42nl95cQtMm9HJaxIS9DCzdt5wn834ch/nqb0fxxH5IBe6v536/izXTeQs20oMT+9Jr7/zAk0uuEqhZWfn06fsPsLWWRJ98vlEJHIyJbqwQvPjscJr90Y/KRQSta+r4XnTPqM6WHlvr5zAJYHL7w1tLKCE5TY2Hee9N5ciPcDUBov7Pv/YtDb2trdIgu8RFUOrFLJr12r1qYRPXX3xzsRKgf5s5gQpYgL781lIaM6Kjip5pyIJ11brDNGfuT/TH342mLh0i1KL36vWH6WOWJZYia5wJpXpUoypqCHMG4VEQoEg9WWP5/TPDeKYtUSCeeHAA/f0vE9Wsm8aCqJC1UGghGHyvPj+KFi2Jp6TT6TSXO9bvnx5O//zrNDX7nEpKU/cPZ5Ph+afuoHUbj/OGgMSbhFgV1XPa5U8+30TTX/1aDRa8yAYca7llZwJNfmK+mjmd8SBNu2zTpg1FRUVRTExMhR+cDwsLY5Z+6rynZ/XHeyKi4VzqFXr372tZ0O2kkYPjlPmGd/iH6SNYK86hhSwUn3zoNpp0b0/64B/rqUmYP8fjpinXzrpNx1SsbOOghnx8hU4mptE/mOXk+3qpe6DNQRvLYI0N146cuMBaznkVu3zh4lVqG9PEGWidXsbDPBls3ZVIDz27QEV0RLUIpqEDY6lX9yh64alh9K//bFF99V9/e4C1so6UfDaTLvCE++GnG+g5NnE/eHuissoQT4xyIDiee2II3T2yE8355Cel2Tu90k4oEBM7NMi5706mhR8/TMFBfspK3LEniabwWIBmOXZUF27PIcL7w4Tx4vThlHA6TV3ff/gszeCJB5t6sKvqDZ6MQ9jKHH1HB3r2pf/SK39eqqyYEUPiaOLYHrRo8S62cg/Q9P8dQq05vtuWHYCONNNxVciOpwfz4NiemHT9Tsw0ySkZahaCUBjYJ0ZpLBC0ew+eVdpTy4jGSugGBvgoEyeFYykRitCtUwtluj3/5FClwVzh7Zfx+87QQV7EiYoMZvMPmlk16/PXW1Lxw7OPDaLnWIj+ZsY3VMwaxGru9HsOptBvua7RXDdnJTDLyMhQZjsEqbk2is/+/v4UEBDAnLy5w9q+nc3e+uGZ0LLbtAplP1g7ZdbDbI1oFqjcKtDIMGHCvEXeWLYiGrNmjncJzTV+32l6dEp/HhikNJE0FrrQbiFcEauJcqHJt+X7vuIJtXwjRBktZM20fZumyty3t+7VeV9n1rAWfPgQHThylt54b4USBNjE4OXJrh6eZM+ev0wDerdW9b+9Xxua99kmnijYX+pWRgP5vC9r6xgTF3hiOcfrCNBKv1q6m8dBKbVt3ZS1urrpO0b/xKS3gC1EjPPs3AJlNR1m8z6ZrQ78DQzAltMy5bLAO45gM33pin08MV6ktT8fVQpUIxaiF9Oy1Q7BZ3hswYTH9aMnUllhOkZPPzpImfmDeWLCNqzdbOEi9hpygqrREK0VTfTe0V0Iwu7t91fTj78cVUJm5pyVFMbmekhjP3rv4x/V+UWL4xVsCNlC9nthwOEzOkuzpgEUEtyQPl24mbDTYsqT/1YAO7ZvRp3jmivTBjNXHJv0+by3v7pnI0uDD5MFZt8S9mXtPnCGYF68wBryuDFdVbss3WP0HDpoZmYmJSUl8fcYZCthCoFq/gOfKK7BL1oTQhSDG513HO9mg18UCf5szXcJN0so+7BHDo2j3qyFhbHfC76tsaM703zWxtA3cL6ALRD4vGNahVCL5oFqcoXJhz4CwTmwbwz9e9FWDpaPop5dI+n/vttFA/q2NoqwxvLPW7CJXp+9XGmh3l6eSnuC7/Zk4kWlSUNQQov6ccMxpZ3D7RMZEazaO5vHxJqfj9Di5Xu5vm5qMgpmDtDgOrFwjmA+obzTrS4m7qLKpQZLDO4taJPYn451AriWEIsMdxs28WBSyWJNezu7MB6d2p8emzaAXnj6DnWcw30BZSAgfhtr4i1Zk394Sj/604t30tfzH1euDbgNftlykpWoc2pBMpHdB9VtznvMmDHjDaPgUSmYXnjB9mwHhHAbPCCWZ4rTtGvvaYpuGUIvPjNcbbPq0z2aBU4KnWIzrU+PKNY6wqgdaxdwJPfmaxCi6Tw7D+7fhgawxrqZ/Wr7eBX4fl6Y6tszmhePWtCm7QlcbrLSguAqgKO+VVQIwXwymvL4SyegIcREhyizw/x+CLDjCWksqMOVU9v8mvYZix0jhrSnSzyDPvXIILprRCftksW/iFTgiViZs2irpWTu00QdUlNTlZDEZ/hG8/LyKv2BWe/lVb4ogbLhwMd9+DFPeMfnU7O483tVWLQzz1PZZ3xhCeoOrUlL6Nw8C6pzjQMbUgzvzIJP+wyznXxvD7X4AGGKxYAR7I7BZFjE5eTxfSPZTIMWByECrWPsnV2UyR7EVglcBGN5Uo5kSwULDZPYnLOnT8IlENs6RKuu+uuRv6TCsbv/pArHRg9iWzehUzyod8Yn0wT28w9j3y4WRGGeww/8yNR+zI2Uxg0+sa3DaNCANtSfhes+tsiwHRETCEKBpo7rRc14AeV7NlszeXFpyrie1JRdIo4kLGQlp6RTbNjGCsWU+IxTgu7nzSdZiz6vFgUrZLBywFVV9zYJbaTGeQf2gyLqApri8VMXCRE6WAg6z2Y8PkOgwlWBaJrm4UHUr3crNcG888EaJXixvoHrMPuhiY5ikx7W6WeLttHm7aeUOwi+0vAmgfTldzvp+MmLhoUo3AtjhnfgRc2bx7ylprrxooTlkWop96/nMIOsWneEhVisMsOsZK33lyCAt8cn0Kih7ZRJYt4gOMyXrT3CC10376nGwIDpAeGEfNCiIZiwwqqZuzBv9cILpqyHexl1aNdU5TV/Hu7DD8KWtIT7IQgTExPVNfhAkcfWhBhSlKGvBzpz/L4U/sKNhtSxXbitxdXLfMCFhc67hrdjdjeaoP9KOFPEdzcu1tAnvEuY/tDeB/aOoddmLVPf0wANzdnpalYBRwscozEdZ1YoGv8exIe1P+ybX/jNLsOTFNoAAa0Sz9VwX8Cd487jARopdkIhubMmWnytVLnnMAkjQgeRGYjIgMyB4IWVo0VewEXAHVcrVglg83O4gG+dMppQ17mzJ9LwwW1v1NtKITdGo5VMcsk4gZ951XUWz57q5fPteNfaAMVMB80JCwj2aE3mtUEHhWYaHR2ttFEjAtS8HPlcNwlgchvFmjgWKb9fdUBNaFhgq08JbYAZbp60cYExYb612MO73MMIxUMLd/PUHJo8hjQBirK0MiyVa36uuj+LEK0mwqPY36f5A/WPgKDz4dVKRwWoVq4mSAMDAw1podr98rduE+jHger4gZZlSXDU7dq7fu1EiFbTO0ZnV4HA1VS+pWJFC7VExXXOiQCtm+/SodV5vR+tbjbRsVr96nKxWogteawWYHYRZWlmv9npWvmIejizbbXSCBseeiu00QYMVb7rW2WShlvcSFvtE6I8urBtL5e3orl6wnY7T0/GZEGyYRLBSnphgfPi83JyEcZhsvS4akNtaTJEJ0I9svnb/V09IfKDXzALEX6Zt3BCOBkWeiwmliwBvN3WiHCxWE4dP4lhDgbYXqviS22or13mfDH/q4x2bZrwSt4JunNYR5ddoce+5E0cNnF73+hK40zxrzxWcfwnwnAacjC0vQmrkQm8C+vshUzq0bnjTeFUKBeDHJ0Yq/HmYU72PtNazCgWv9C279ccpnAOncFCmCvKGIRF/cSB2lEtglQURWVhZWCMLwoJDa6bsZj29gHtPvyPsPWbj1O/Hi20UxX+4tuVxvC+9iUr9pfvU8dOCBdMiCfHLrLOcc34G6U43syGZFeIE8pFuE75boNUJWCw+d+VEmLxsH0R4T0tI4IsCrVyDm684yKVEk9nqvg9ezhw4BIrQm68I8WTA8dbqC/ksDaYIUSdlawJY6yQYnDt4n+dga23Slurpd1fzmqveTl4x5iYIEA7tQ9Xsa3m1/UhTsv2/1FtVuCAMPNs9f4zOGA8x8U2oVY8cXqkTavQJoQ4ISEg/hjHXX63fB9hF5krae4w4dG/2/GW4fs5hhf/GgSKhC3JbiGKwgEeydaHqcz16Jet7Sv/RvDy3VSONE99iz5r+ejUdSVBkOLH2n88rSt1tace1tqnF6IloV+6cF/HxOCm2qdvtyZEwRd9FP3dVRNGHmJRrSkx+rbbZc5rhbiq8DTaPmdtKa2LggqdyUiH0tjVl79G2leW/S25qvjQpu2q2oc+Whf7aW32N4eEaG1WXJ4tBGqagKmg4jbQmn6+PK9uEqhq4qmbtZZaCQEhIATqCAERonXkRUg1hIAQqJ8ExJyvn+9Nal0DBIob3FcDT5FH1HcCDq3O1/fGS/2FgBAQAo4SEHPeUYJyvxAQArc0ARGit/Trl8YLASHgKAGTK+06cBSG3C8EhIAQAAEj3xFgysy8ItSEgBAQAkJAI8Bbgf38fPlb8T1tEqYm7wYNtFvlrxAQAkLglieQlZXFX5juja/ct4mFKSS4/H+/25RbMgkBISAEXJwA/tGjkSQLS0ZoSV4hIASEgI6ACFEdEDkUAkJACBghIELUCC3JKwSEgBDQERAhqgMih0JACAgBIwREiBqhJXmFgBAQAjoCIkR1QORQCAgBIWCEgAhRI7QkrxAQAkJAR0CEqA6IHAoBISAEjBAQIWqEluQVAkJACOgIiBDVAZFDISAEhIARAiJEjdCSvEJACAgBHQERojogcigEhIAQMEJAhKgRWpJXCAgBIaAjIEJUB0QOhYAQEAJGCIgQNUJL8goBISAEdAREiOqAyKEQEAJCwAgBEaJGaEleISAEhICOgAhRHRA5FAJCQAgYISBC1AgtySsEhIAQ0BEQIaoDIodCQAgIASMERIgaoSV5hYAQEAI6AiJEdUDkUAgIASFghIAIUSO0JK8QEAJCQEdAhKgOiBwKASEgBIwQECFqhJbkFQJCQAjoCIgQ1QGRQyEgBISAEQIiRI3QkrxCQAgIAR0BEaI6IHIoBISAEDBCQISoEVqSVwgIASGgI/D/bqy4O7pwVp4AAAAASUVORK5CYII=)

### Enforce a staged policy

1. From **Policies Board**, click a staged policy.
2. Click **Edit policy**, make changes and click **Enforce**. The staged policy is deleted and the enforced policy is created/updated (depending on whether it already exists).

### Preview policy impact

The policy preview impact feature assesses traffic impact only on *enforced staged policies*.

1. From the **Policies Board**, select a staged policy and click **Edit policy**.
2. Make some edits and click **Preview**.

![policy-preview](https://docs.tigera.io/assets/images/policy-preview-b2efca933be175d85ece43ac331086e2.png)

### Stage updates to an enforced policy

1. From the **Policies Board**, open an enforced policy.
2. In **View Policy**, click **Edit policy**.
3. Make your changes, and click **Preview**. Depending on the results, you can click **Stage** or **Enforce**.

You can also use custom resources to stage Kubernetes and Calico Enterprise policies, and apply them using `kubectl`. Here are sample YAML files.

**Example: StagedGlobalNetworkPolicy**

```yaml
apiVersion: projectcalico.org/v3
kind: StagedGlobalNetworkPolicy
metadata:
  name: default.allow-tcp-6379
spec:
  tier: default
  selector: role == 'database'
  types:
    - Ingress
    - Egress
  ingress:
    - action: Allow
      protocol: TCP
      source:
        selector: role == 'frontend'
      destination:
        ports:
          - 6379
  egress:
    - action: Allow
```

**Example: StagedNetworkPolicy**

```yaml
apiVersion: projectcalico.org/v3
kind: StagedNetworkPolicy
metadata:
  name: default.allow-tcp-6379
  namespace: default
spec:
  tier: default
  selector: role == 'database'
  types:
    - Ingress
    - Egress
  ingress:
    - action: Allow
      protocol: TCP
      source:
        selector: role == 'frontend'
      destination:
        ports:
          - 6379
  egress:
    - action: Allow
```

**Example: StagedKubernetesNetworkPolicy**

```yaml
apiVersion: projectcalico.org/v3
kind: StagedKubernetesNetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - ipBlock:
            cidr: 172.17.0.0/16
            except:
              - 172.17.1.0/24
        - namespaceSelector:
            matchLabels:
              project: myproject
        - podSelector:
            matchLabels:
              role: frontend
      ports:
        - protocol: TCP
          port: 6379
  egress:
    - to:
        - ipBlock:
            cidr: 10.0.0.0/24
      ports:
        - protocol: TCP
          port: 5978
```

## Additional resources

- [Staged global network policy](https://docs.tigera.io/calico-enterprise/3.21/reference/resources/stagedglobalnetworkpolicy.md)

- [Staged network policy](https://docs.tigera.io/calico-enterprise/3.21/reference/resources/stagednetworkpolicy.md)

- [Staged Kubernetes network policy](https://docs.tigera.io/calico-enterprise/3.21/reference/resources/stagedkubernetesnetworkpolicy.md)

- For details on how to configure RBAC for staged policy resources, see [Configuring RBAC for tiered policy](https://docs.tigera.io/calico-enterprise/3.21/network-policy/policy-tiers/rbac-tiered-policies.md)

- For details on staged policy metrics, see

  - [Flow logs](https://docs.tigera.io/calico-enterprise/3.21/observability/elastic/flow/datatypes.md)
  - [Prometheus metrics](https://docs.tigera.io/calico-enterprise/3.21/operations/monitor/metrics.md)