Halting enforcement

Halting is the workspace-wide pause. While it holds, every policy runs as Monitor, whatever its own state says. Nothing is stopped, redacted or asked; hits are still recorded. No policy is changed, so resuming puts every one of them back exactly where its author left it.

Who can do it

Halting and resuming both need policies:publish (Enable policies), the same permission that enables a policy. Owner, Admin and Policy author hold it. There is no second approver, so the control can be reached during an incident.

Halt a workspace

Send POST /policies/enforcement/halt with a reason. The reason is required: "halting enforcement needs a reason: the person who finds it halted three days from now is usually not the person who halted it". The request is recorded in the audit log as policy.enforcement_halted and republishes what runs, so the console never says halted while machines still enforce. Machines pick the change up on their next heartbeat.

See that it is halted

Governance › Policies shows a note above the tabs:

• Enforcement is stopped for this workspace.
• "Every policy runs as Monitor, whatever its own state says."

The hint beside it holds the reason given, when it was stopped ("Stopped" and a time), and "No policy was changed. Resuming puts every one of them back exactly where its author left it."

Resume

1. Open Governance › Policies.
2. In the note, choose Resume enforcement.

The change is recorded as policy.enforcement_resumed and reaches machines on their next heartbeat. You can also send POST /policies/enforcement/resume.

This is not the same as setting every policy to Disabled

The Change many at once menu on the Policies page can set every policy to Disabled. That edits each policy, and its confirmation warns: "No machine checks or blocks anything until policies are set back." A halt edits none. Switching a group Off pauses only that group's policies; see Policy groups.

When it goes wrong

With the API

Both calls are in the Policies reference. The current state, including any halt, is returned by each of them.