Modes
The dashboard shows Pause after you enforce a policy. When you pause the workspace, the dashboard disables New policy and row actions. Click Resume to restore the previous policies.
How a change reaches endpoints
Endpoints check for policy changes about once a minute. The top card on Policies compares recent decisions with the current mode:- A catching-up badge means the newest reported decision used a different mode from the current workspace setting. Check a new decision from each rollout endpoint to confirm it applied the change.
- A mode-set-locally badge means the endpoints’ managed configuration fixes their mode to Observe or Enforce. Those endpoints ignore the dashboard mode. You cannot clear the badge by waiting.
kontext setup follow the dashboard mode. An MDM package can set Observe or Enforce, or follow the dashboard. Endpoints that follow the dashboard stay in Observe until they fetch an Enforce deployment.
How the dashboard counts calls
The dashboard counts the newest 2,000 recorded Deny decisions in the window for enforced rows, labelled “blocked”. For observing rows, labelled “would block”, Kontext replays the newest 2,000 recorded calls against observing policies. Before you enforce any policy, Kontext compares each policy with Allow tool use unless blocked alone. Afterwards, Kontext compares it with the enforced set. Replay runs nothing on endpoints. Kontext can assess policies that read tool input only when it captured the full input without redaction.Failure behavior
As of CLI v1.8.1, the hook that runs before the tool behaves like this:
An endpoint that follows the dashboard uses Enforce behavior once it caches an Enforce deployment. It keeps Enforce mode during an outage, even with a stale cache.