Publish a passport: approvals, overrides and second-factor checks
Why publishing can ask for an override and a fresh authenticator code, who may approve, and how long an approval stays valid.
DPP Shield editorial team · Updated:
Publishing is an accountable declaration. An owner or administrator publishes after confirming a second factor in the last 15 minutes; if required findings remain, or the regulation pack is a draft readiness pack, a different owner or administrator must first approve a publication override for that exact version.
Two gates before a passport goes public
When you publish, DPP Shield validates the version again. Required findings - the errors in the validation results - block publication. Separately, the pack behind the category must be a legally reviewed, approved pack: the packs bundled with DPP Shield are draft readiness packs, so until your platform operator activates a reviewed pack, every publication needs an accountable override. That is deliberate: a readiness score is not a legal assessment, and someone has to own the decision.
Request and approve an override
An approved override is valid for 14 days, for that exact passport version and those markets. Saving a new version, or publishing for other markets, needs a new request. Every request, decision, reason and approver is recorded in the audit log and in the publication record.
- Validate the passport and read every finding.
- Choose Publish. If the gate refuses, enter a specific reason of at least 10 characters - what was checked and why it is acceptable - to request an override. Editors use Request publication review.
- A different owner or administrator opens the passport and approves or rejects the request.
- Once approved, an owner or administrator publishes the version.
If you are the only administrator
You cannot approve your own request while another owner or administrator exists. In an organization with a single owner or administrator, an owner can allow sole-administrator approval under Settings, Security; the decision is then recorded as self-decided. Inviting a second administrator is the better control.
The second-factor check
Publishing, deciding an override, registering a release in the EU registry and bulk publish, recall or archive require a second factor confirmed in the last 15 minutes. On DPP Shield a second factor is mandatory for these acts, and API keys cannot perform them. Enrol an authenticator app under Settings, Security and sessions first, and keep the recovery codes.
When the check is due, the console sends you to the verification page: enter the code from your authenticator app and you return to the passport to finish.
After publishing
The published version is frozen; later edits create a new version that stays private until it is published in turn. Publishing issues the passport's authenticity credential automatically, and it is renewed before it expires. Recall keeps the public page and states the recall, and revokes the passport's credentials; archive retires the passport while its last release stays readable; reinstate opens a recalled or archived passport for correction.