> ## Documentation Index > Fetch the complete documentation index at: https://docs.befailproof.ai/llms.txt > Use this file to discover all available pages before exploring further. # Prevent your first failure with a policy > Author a policy version, deploy it in observe mode, and then enforce it. Use a policy only after you can describe the unsafe action and the legitimate actions that must remain allowed. Go to **Admin → policy editor**. Start with the demo policy, review or edit its source, then select **publish version**. Publishing creates the immutable version that you can deploy to machines. The Policy editor compose view with a demo policy ready to publish as an immutable version. Go to **Admin → enforcement**, expand the target machine, and select **edit this machine**. Add the published demo policy, pin its version, choose **observe**, and apply the deployment. The machine deployment editor with a published policy version selected in observe mode before applying the deployment. Run a new agent session on that machine, then open **Observe → policy**. Select the machine and confirm that the demo policy appears in the policy mapping and decision timeline. Observe mode records what the policy would do without blocking the action. The Policy page showing decision totals, enforcement activity over time, and local and Cloud-managed policy mappings. Cloud policy authoring and fleet deployment are administrative workflows. Use the local CLI to validate the same policy before publishing it: ```bash theme={null} failproofai policies --install --custom ./payment-retry.policies.ts \ --cli claude --scope project failproofai config --status ``` Use `fp` to inspect Cloud-visible policy decisions: ```bash theme={null} fp events --event-type hook_completed --env production --since 24h fp sessions --env production --since 24h ``` The Cloud CLI does not expose root-only enforcement deployment routes. Publish versions from **Admin → policy editor** and deploy them from **Admin → enforcement**.