> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Rollout and failure behavior

> How policy changes reach endpoints, and what endpoints do when a check fails.

Kontext saves and deploys every action on **Authorization → Policies** immediately. Endpoints apply policies according to the workspace mode, their local configuration, and their last check-in.

## Modes

| Mode    | When                                            | What endpoints do                                                                               |
| ------- | ----------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| Observe | You have enforced no policies yet.              | Endpoints evaluate observing policies and record what they would deny. They let every call run. |
| Enforce | You clicked **Enforce** on at least one policy. | Endpoints block calls with enforced policies. The dashboard keeps observing policies.           |
| Paused  | You clicked **Pause**.                          | Endpoints skip policy checks and let every call run. They keep recording tool calls.            |

The dashboard shows **Pause** after you enforce a policy. When you pause the workspace, the dashboard disables **New policy** and row actions. Click **Resume** to restore the previous policies.

## How a change reaches endpoints

Endpoints check for policy changes about once a minute. The top card on **Policies** compares recent decisions with the current mode:

* A catching-up badge means the newest reported decision used a different mode from the current workspace setting. Check a new decision from each rollout endpoint to confirm it applied the change.
* A mode-set-locally badge means the endpoints' managed configuration fixes their mode to Observe or Enforce. Those endpoints ignore the dashboard mode. You cannot clear the badge by waiting.

Endpoints set up with `kontext setup` follow the dashboard mode. An MDM package can set Observe or Enforce, or follow the dashboard. Endpoints that follow the dashboard stay in Observe until they fetch an Enforce deployment.

## How the dashboard counts calls

The dashboard counts the newest 2,000 recorded Deny decisions in the window for enforced rows, labelled "blocked". For observing rows, labelled "would block", Kontext replays the newest 2,000 recorded calls against observing policies. Before you enforce any policy, Kontext compares each policy with **Allow tool use unless blocked** alone. Afterwards, Kontext compares it with the enforced set.

Replay runs nothing on endpoints. Kontext can assess policies that read tool input only when it captured the full input without redaction.

## Failure behavior

As of CLI v1.8.1, the hook that runs before the tool behaves like this:

| Condition                                     | Observe                                        | Enforce                                                                                                          |
| --------------------------------------------- | ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| The policy allows the call                    | The call runs.                                 | The call runs.                                                                                                   |
| The policy denies the call                    | The daemon records Deny. The call runs.        | The hook blocks the call.                                                                                        |
| Policy evaluation or request conversion fails | The daemon records the failure. The call runs. | The daemon records the failure. The call runs unless another request in the same compound command returned Deny. |
| The endpoint has no usable policy             | The call runs.                                 | The hook blocks the call as "enforcement not ready".                                                             |
| The hook cannot reach the Kontext daemon      | The call runs.                                 | The hook blocks tool calls. It allows informational events, such as prompt submission.                           |

An endpoint that follows the dashboard uses Enforce behavior once it caches an Enforce deployment. It keeps Enforce mode during an outage, even with a stale cache.

## Offline endpoints

Endpoints use valid cached policies without an age limit. They keep the cached policy until they fetch a valid replacement, even if they reject an update. Offline endpoints evaluate cached policies and send recorded calls to the dashboard later.

## Roll back

Click **Stop enforcing** to stop one policy from blocking. Kontext keeps a copy in Observing. Click **Pause** to stop all blocking. If an MDM package sets Enforce on endpoints, change that configuration too. Check new decisions in [Explore](/explore/overview). Offline endpoints keep the previous behavior until they check in.