Observe and enforce

Each agent runs in one of two modes:

• Observe: Thoth evaluates every action exactly as it would when enforcing, records the decision it would have made, and lets the action run. Nothing is denied or held.
• Enforce: decisions apply. Denied actions don't run, held actions wait for a person to approve them, and allowed actions run.

An agent with no mode set enforces: every default policy and profile does.

Decisions

Thoth's decisions are the five of the AARM specification:

In observe, each of these is recorded as what enforcing would have done, and the action runs.

What enforcing would change

For an agent in observe, the observe summary counts what enforcing would have denied, held, modified or deferred over the last 7 days (up to 30), with the rules that matched most and recent examples you can open in Activity.

thothctl agents observe-summary --agent-id billing-agent

GET /{tenant}/thoth/v1/agents/{agent_id}/observe-summary?days=7

Changing the mode

Changing an agent's mode needs an admin with a recent second factor. A signed-in thothctl session confirms it in the browser; an API key used by Terraform does not need to.

thothctl agents mode set --agent-id billing-agent --mode observe
thothctl agents mode set --agent-id billing-agent --mode enforce
thothctl agents mode get --agent-id billing-agent

resource "thoth_agent_enforcement" "billing" {
  agent_id         = "billing-agent"
  enforcement_mode = "observe" # observe | enforce
}

Destroying the Terraform resource returns the agent to enforce. In Pulumi the resource is thoth.governance.AgentEnforcement. The thothctl commands need thothctl 0.3.12 or later, and the Terraform resource provider 0.1.22 or later.

From an MCP client connected to the configuration server, ask for preview_enforcement_mode. The preview states what changes for the agent; committing it while signed in returns an approval link you confirm in the browser with MFA. The agent must be registered first.

When a risk score is high

Rules decide every action. Where a model risk score is available, it can only make a decision stricter, never allow something the rules would not. While enforcing, high_risk_action says what a high score does: hold the action for approval (the default) or deny it.

Older mode names

Earlier versions used other names. They are still accepted and stored as the two modes: monitor and shadow are observe; review, step_up and progressive are enforce; block is enforce with high_risk_action = deny.