Guide

Shadow mode authorization

Observe before you enforce.

Shadow mode records ALLOW, DENY, and APPROVAL_REQUIRED decisions without blocking execution — until operators promote gating per workflow.

Why shadow mode exists

Flipping enforcement on day one breaks production. Shadow mode lets teams see what would have been denied or escalated while automations keep running.

Promotion criteria

Most pilots run shadow mode for weeks 1–2 of a four-week Authority Surface Map engagement.

  • False positive rate acceptable for the workflow
  • Approval routes staffed and tested
  • Evidence review process in place
  • Authority Readiness level supports gating

Frequently asked questions

Does shadow mode reduce security?

It defers enforcement, not evaluation. Teams gain visibility before committing to block paths.

Related

Next step

Map your workflows

See where action authority fits in your stack — no credentials required.