Until now, every organization on the console got the same behavior: whatever the engine decided, the proxy passed through. That’s the right default for a demo, and it’s the only mode we had for the beta. But “the same behavior for everyone” isn’t a rollout strategy for a product that can block commands.
So this week we shipped enforcement modes. The principle is simple: audit first, enforce second.
The two modes
Every organization now starts in audit mode. The engine still evaluates every command exactly as it would in production — same rules, same verdicts — but what reaches the caller is a prediction, not a block. The real verdict travels alongside, under its own key, and the response is marked enforced: false. Downstream systems see everything the engine decided, and nothing actually stops.
When an org is ready, an admin flips it to enforce mode. From that moment, verdicts pass through untouched and carry enforced: true. One toggle, no restart, no redeploy.
This gives partners what a deterministic security product should offer: a rehearsal that is byte for byte the real performance. In audit mode you can watch the guardrail block things for a week, tune your policy, and know — not hope — what enforce mode will do on day one.
Attribution without new accounts
There’s an old tradeoff in API design: easy to adopt, or easy to audit. We picked the unglamorous path. Enforcement behavior is attributed to an organization through its API keys — the console keys an org already issues to its services. Anonymous requests and demo calls pass through unchanged, so nothing breaks for existing users. But an org that wants behavior attributed per key gets it: every check is attributed, and every key has its own rate limit, enforced before a request ever reaches the engine.
This is a deliberate choice, and it has a known cost: if your integration calls the proxy without a key, we can’t tell your org apart from anyone else’s. We’d rather be accurate than clever. Keys are how services identify themselves, and a security product that guesses about identity has failed before it starts.
The boring half
The rest of this release is the kind of thing nobody writes a launch post about, but operators notice first: structured JSON logs. Set one environment variable and both serve binaries emit JSON lines instead of prose — the difference between “grep the log” and “query the log.” For a product whose customers run it at the boundary of their infrastructure, that’s not a feature, it’s basic respect.
What we didn’t do
We didn’t add pricing. The tier gate exists — enforce mode requires a paid plan, audit is free — but commercial terms are still not part of the beta. That’s deliberate, not forgotten: the beta’s job is to prove the enforcement flow, not to test a price list.
The checklist that matters: zero unexpected blocks, prediction equals actual, root bypass demonstrated. Audit, then enforce: that’s how every new partner walks the list, starting today.