Modes

Every intent policy runs in one of three modes in each zone that holds it. The mode decides whether a match is only recorded or whether its verdict is applied before the action runs.

Figure 1. The same actions in Monitor and in Enforce: in Monitor they cross the boundary and are recorded; in Enforce the verdict applies first.

Mode	What it does
Disabled	The policy is kept, with its history, but nothing is evaluated
Monitor	A match is recorded and flagged, and the action proceeds
Enforce	The client applies the policy’s verdict before the action runs, and records whether it did

The mode belongs to the policy in a zone, never to a single atom. One exception is built into the atom itself: an atom whose class is monitor-only can be watched but not enforced, so it stays in Monitor even when its policy runs in Enforce.

Earn Enforce on evidence

Start a new policy in Monitor. It records every action it would have decided, without changing what the agent does. Read its anomalies: when they show the policy says what you meant, switch it to Enforce. When they show it does not, edit it or disable it.

OpenLatch never widens an agent’s authority on its own. Every move from Monitor to Enforce, and every new policy, is a choice someone in your organization makes.

One policy, several zones

The same policy can sit in several zones, each with its own mode, for example Monitor in one team and Enforce in another, with no copy to keep in step.

Rule	What it means
Strictest wins	When an agent’s path holds the same policy more than once, it runs once, in the strictest mode: Enforce over Monitor over Disabled
A zone only tightens	A policy is switched on in a zone only if it does not loosen the zones above it. Holding it Disabled is always allowed
Lowering is never blocked	Moving a policy from Enforce to Monitor, or to Disabled, is always allowed
One version everywhere	Every zone runs the policy’s current version, each in its own mode