Go to Admin → enforcement, find the machine, and expand its row.
Select edit, add the reviewed policy version, and choose observe or its enforcing effect.
Apply the change, then wait for the machine’s next check-in and confirm its deployment and coverage state.
Go to Observe → policy to inspect live decisions.
Deploy from the CLI with fp fleet. Review the resulting set before applying it — deploy prints the full plan and asks only on an interactive terminal without --json. Under --json, with --yes, or with stdin redirected (a CI step, a script, an agent shelling out) it applies immediately with no plan and no prompt — so run fp fleet show <machine> first if you want review:
fp fleet diff <machine-id> shows intent vs delivery (a machine reads as behind until it next polls), fp fleet history <machine-id> lists the generations, and fp fleet rollback <machine-id> <generation> reinstates one — it refuses if that generation names a policy since disabled or deleted.Check the machine itself with failproofai config --status, and use fp sessions --env production --since 24h and fp events --event-type hook_completed after deployment to verify activity reaches Cloud.
1
Choose the version and targets
Deploy a reviewed version, not a mutable draft, starting with a non-production machine or small cohort whose sessions you can inspect.
2
Observe decisions
Review matches, reasons, affected tools, and false positives without blocking work.
3
Enforce and verify coverage
Promote after observed matches separate unsafe actions from valid ones, then confirm every intended machine has pulled the deployment and is reporting decisions.
Machines need the policies:pull capability. Event reporting is separately controlled by events:add; verify both when you expect Cloud analysis and enforcement.
Enforcement management is an administrative Cloud workflow. Do not treat root-only enforcement routes as ordinary customer /v1 API endpoints.
