Remove authorization policies in Splunk Web

When you remove an authorization policy from a capability, you restore that capability to its former scope.

To remove authorization policies for a capability on the Splunk platform, you must run a version of the Splunk platform that supports the editing and removal of authorization policies. You must also hold a role that contains the edit_policies capability.
After you delete an authorization policy, you must re-create it and perform the proper role and capability mappings for it to function again.
  1. Log into your Splunk platform instance as an administrator user or equivalent.
  2. From the system bar, select Settings > Policy Management. The Policy Management page loads.
  3. In the Policy Management page, select the button with three vertical dots in the row for the policy that you want to change. In the menu that pops up, select Delete. Splunk Web immediately deletes the policy.
    CAUTION: Be careful when deleting policies, as you cannot undo this action.
After you delete an authorization policy, any mappings that include the policy are no longer valid, and the capabilities that the policy modified are restored to their former scope. To limit the scope of the affected capabilities again, you must create new authorization policies.