Monitor Mode — watch it be right, then enforce

Day one of a rollout should be the safest day, not the most dangerous one. In observe, Unveilr computes and seals every decision exactly as it would in enforce — and blocks nothing.

New tenants start in observe. Enforcement is an explicit act.

The two invariants

1. The decision does not change. observe and enforce produce the identical decision, policy outcome and ruleSetHash from identical inputs. Only the consequence differs. If they diverged, the monitor period would be worthless as evidence for the enforce period — you would be watching something other than what you are about to turn on.

2. Observe cannot cause a side effect. In particular it never mints a scoped credential: issuance calls AWS STS and hands out real authority, which a monitoring deployment must not do. Observing is not a licence to issue power.

What a decision looks like

// observe — the control decided deny, and did not act on it
{
  "decision": "deny",
  "allowed":  true,
  "mode":     "observe",
  "enforced": false,
  "reason":   "[monitor] would deny: policy deny: matched \"no production writes\""
}

// enforce — same decision, now applied
{ "decision": "deny", "allowed": false, "mode": "enforce", "enforced": true }

Your integration should branch on allowed — what the control did — while decision tells you what it concluded. Every decision is sealed either way, so the monitor period is a real record you can review before flipping.

Configuring it

# read
curl -s "$API/v1/govern/enforcement" -H "Authorization: Bearer $TOKEN"

# enforce ONE agent and one tool family, while the rest of the estate observes
curl -s -XPUT "$API/v1/govern/enforcement" -H "Authorization: Bearer $TOKEN" \
  -d '{"default":"observe","enforceAgents":["fraud_agent"],"enforceTools":["aws.*"]}'

Field	Meaning
default	observe (default) or enforce, estate-wide
enforceAgents	These agents enforce regardless of the default
enforceTools	Tool globs that enforce regardless of the default

The allow-list shape is deliberate: name what to enforce, so the safe state is the one you get by doing nothing. Enforcing one path while everything else observes is the recommended pilot shape.

Flipping the default is sealed as evidence with the operator who did it — enforcement starts stopping real work, so it is never a silent toggle.

What Monitor Mode does not soften

• Session termination. An operator pulling the kill switch is not a policy outcome; a terminated session is denied in observe too.
• Authentication. An unknown, revoked or expired credential is always denied.

The MCP gateway

The gateway has its own mode with the same vocabulary (GATEWAY_MODE_DEFAULT, defaulting to observe, plus GATEWAY_MODE_OBSERVE_SERVERS to force specific servers to observe).

Why there is no fail-open switch

A control whose guarantee evaporates exactly when the system is under stress is not a control. Monitor Mode is the supported way to not block — chosen deliberately up front, rather than implicitly during an incident. See Reliability.