Who rated this post

There are only three instances where an Access Policy installation is required when making Threat Prevention configuration changes:

• Very first policy installation on gateway (Threat Prevention requires an Access Policy to be installed)
• When Inspection Settings are edited
• When a "Core Protection" is edited 

The reason this is necessary is because Core Protections and Inspection Settings are actually implemented in the firewall code.
Changes to that configuration require an Access Policy installation.

When you edit a Core Protection, SmartConsole explicitly warns you of this:

Same with editing Inspection Settings:

If you've identified something outside of the above circumstances, I suggest involving TAC.