Skip to main content

From monitor to enforce

A packaged fresh install ships in monitor mode: every detector runs, every match is recorded, and nothing is redacted or blocked. That is a property of the shipped policy.yaml — every rule's action is log — not of the agent. Blocking legitimate work is as costly as missing an attack, so the intended path is: collect, tune, then enforce.

1. Collect on real traffic​

Run in monitor mode long enough to see your organization's actual AI use. The findings file is the tuning corpus:

# Which rule would be doing the work
jq -r 'select(.action.effective!="log") | .action.by_rule' findings.jsonl | sort | uniq -c

# What a monitor-mode policy *would have* done
jq -r 'select([.detections[] | select(.matched)] | length > 0) | .action.reason' findings.jsonl
caution

In monitor mode the findings file holds interactions as they were seen, secrets included — nothing is redacted until a rule says so. Treat the file as sensitive from day one, and promote pr_secrets first.

2. Promote a rule​

Promoting is a one-word change:

- id: pr_secrets
  detector: sensitive_data
  subclasses: [credentials, financial, pii]
  applies_to: [prompt, response]
  action: log          # <- change to `redact` to start stripping secrets

Bump the policy version, save, and the running agent hot-reloads it within about two seconds — same process id, no restart:

curl -s 127.0.0.1:7645/v1/policy | jq .version          # new version live
curl -s 127.0.0.1:7645/v1/inspect -d '{"stage":"input","text":"the key is AKIAIOSFODNN7EXAMPLE"}'
# → "action": "redact", "text": "the key is [REDACTED:credentials]"

3. Verify what is actually in force​

lumen-agent policy validate --policy /etc/lumen/policy.yaml
lumen-agent policy effective --config /etc/lumen/agent.yaml
policy source: /etc/lumen/policy.yaml
policy id:     pol_packaged_monitor   version 2   sha256 993496456bd5
mode:          MONITOR - every detector runs and nothing is redacted or blocked

policy effective resolves agent.policy exactly the way the daemon does. If it says source embedded, the daemon is running the enforcing policy compiled into the binary — your file is not wired in. See Configuration for why that happens.

Failure posture​

Per policy, choose what happens when detection itself fails:

  • Fail-open (default): a local error or an unreachable cloud → proceed and Log. Lumen never becomes an outage in the user's AI tool.
  • Fail-closed (high-security): a local error on an enforcing policy → Block.