Graduate a policy to Enforce
Run a policy in Monitor until its record shows that it decides what you expect, then switch it to Enforce. You need the editor role or higher, on the unit that authored the policy.
In Monitor, a policy records its anomalies and never intervenes. In Enforce, the client applies its verdict before the action runs. Modes explains the difference.
Decide when to graduate
Section titled “Decide when to graduate”Graduate a policy when its record over a representative period, a week of normal work for most teams, holds no surprise:
| Check | Where |
|---|---|
| Every anomaly it raised is an action you want it to act on | The policy’s Activity, then Anomalies filtered to the policy |
| It raised no anomaly on work you consider normal | The same list, read with the agent owners |
| Its intents reach the enforce bar | The policy drawer. An intent marked monitor-only raises anomalies and never intervenes, in any mode |
When the record shows a false positive, change the policy instead of graduating it: open it, answer No to its sentence with what you meant, and ratify the new version in Monitor.
Switch the mode
Section titled “Switch the mode”- Open Autonomy Zone, select the unit that authored the policy, and open Policies.
- In the policy’s row, open its actions and set Mode to Enforce. To graduate several policies at once, select them and choose Enforce.
- Each client applies the change on its next poll. To apply it at once on a machine, run
openlatch system aip refresh.
From then on, the client decides the policy’s enforceable intents before the action runs: Allow, Ask, Block or Optimize. An Optimize lever acts only in Enforce; in Monitor it measures what it would have done. Each policy’s mode is recorded in the audit trail with who changed it.
Step back
Section titled “Step back”To step a policy back, set its mode to Monitor. It keeps recording its anomalies and stops intervening on the next poll. Set it to Disabled to stop evaluating it altogether; its history stays available.