Redoing the security deployers, I came across this thing which I had not given a lot of thought before.

* You can link a child PolicyConfiguration to a parent only if it is not committed (or inService).
* A commit on the parent policyConfiguration does not commit the children.

I looked at the API javadocs as well as in the spec. There is no cascaded commit.

So basically you have to link the child PC and then commit it. The ParentPC commit can happen irrespective of whether the linked PCs are committed (ie. inService or not).