Deploy a policy

A deployment puts published policy versions on a machine, each with one of two effects:

Observe records what the policy would have done, and blocks nothing.
Enforce acts on the decision: a deny blocks the call and an instruct steers the agent.

Add a machine

A machine appears under Admin → enforcement once it is connected to Cloud. If the one you want is not there yet:

Dashboard
CLI

Go to Administration → Keys and create a key with policies:pull, so the machine can receive deployments, and events:add, so its decisions reach Cloud.
Connect the machine with that key — Connect a machine to Cloud walks through it.
Confirm it shows up under Admin → enforcement.

On the machine:

npm install -g failproofai
failproofai config
failproofai config --status

In a terminal, failproofai config asks whether to connect to Cloud and takes the key at a masked prompt. Then confirm the machine is enrolled, from anywhere, with fp fleet list.

Deploy in observe mode

Dashboard
CLI

Go to Admin → enforcement, find the machine, and expand its row.
Select edit, add the tested policy version, and choose observe.
Apply the change, then wait for the machine’s next check-in and confirm its deployment and coverage state.
Go to Observe → policy to inspect live decisions.

fp fleet list
fp fleet show <machine-id>
fp fleet deploy <machine-id> --add no-force-push:observe

The :observe suffix is what makes it observe: a bare --add no-force-push keeps the effect the machine already has for that policy, and otherwise enforces. Switch it to enforce later with --add no-force-push:enforce.deploy replaces the machine’s whole policy set with the result. It prints the plan, then asks before applying — but only on an interactive terminal. With --yes, under fp --json, or with stdin redirected (a CI step, a script, an agent shelling out) it applies without asking; the plan is still printed, or returned as plan under --json.On the machine, failproofai policies lists the Cloud-managed policies it is running and failproofai config --status shows its connection. Use fp sessions --env production --since 24h and fp events --event-type hook_completed to confirm its activity reaches Cloud.

Choose the version and machines

Pick the published version and the machines it should run on.

Observe

Review matches, reasons, affected tools, and false positives while nothing is blocked.

Enforce

Switch the effect to enforce once the observed matches separate unsafe actions from valid ones, then confirm every intended machine pulled the change and is reporting decisions.

Check coverage

Coverage answers whether a policy is running where the risk is.

Go to Admin → enforcement and review the enforcing and observing totals.
Search for a machine by ID or label, or filter for machines missing a policy.
Expand a row to compare assigned policies, reported deployment, last check-in, and history.
Refresh after the machine’s polling interval when an applied deployment is still pending.

The Enforcement fleet showing policy coverage, machine deployment state, and observe and enforce assignments.

Look for machines that never pulled the latest deployment, enrolled machines that stopped reporting, a policy assigned to the wrong environment, and version drift after an interrupted update. Label machines by workload and environment — hostnames alone rarely survive autoscaling or replacement:

failproofai config --machine-label checkout-runner-03

Enforcement management is an administrative Cloud workflow. Do not treat root-only enforcement routes as ordinary customer /v1 API endpoints.

Prevent repeat failures

Get a policy

Ship a policy

Add a machine

Deploy in observe mode

Check coverage

​Add a machine

​Deploy in observe mode

​Check coverage

Add a machine

Deploy in observe mode

Check coverage