The city authors an internal access-control policy that must be reviewed, approved, and made active for the organization. Which lifecycle outcome is required?

Internal policies in IRM follow a record lifecycle from draft through review and approval into published or active states. Only after that gate should the policy be treated as obligatory for the organization. Generating production obligations from permanent drafts, or managing policy solely outside IRM, undermines controlled lifecycle management.