Why blocking your AI agents is the wrong first move

5 min read

Most AI governance tools lead with enforcement: put us in the path and we will block unsafe actions. It is a strong demo and a hard sell, because it asks a platform team to accept a new dependency that can take production down. Monitor mode inverts the order — observe and record first, enforce once the rules have been proven against real traffic.

The availability objection

An enforcement gate is, by construction, on the critical path. If it is slow, your agents are slow. If it is down, your agents are down. If a rule is wrong, it blocks legitimate work in production.

Platform teams know this, which is why enforcement-first governance tools tend to stall in security review rather than in the demo. The objection is not philosophical; it is an availability risk assessment, and it is usually correct.

What monitor mode changes

In monitor mode the governance layer evaluates every action and records a verdict, but the verdict is advisory. The calling application decides what to do with it. Nothing blocks, so nothing can be broken by the governance layer being wrong or unavailable.

That single property removes the deployment objection entirely. It also produces something more useful than a policy document: a week of real data on what the rules would have blocked, before anyone depends on them.

The honest trade-off

Monitor mode does not stop anything. If an agent exfiltrates data, a monitor-mode system records it precisely and prevents nothing. Anyone selling monitor mode as a security control is overselling it.

What it is: an accurate, complete, provable record, and a way to tune enforcement rules against real traffic before they can cause an outage. Enforcement remains the destination. Monitor mode is how you arrive with rules that work.

Moving to enforcement

The transition is a decision the customer makes in their own code, which is the point. A workable path:

  • Deploy in monitor mode and log verdicts without acting on them.
  • Review what would have been blocked; most early findings are mis-scoped rules, not misbehaving agents.
  • Tune until the false positive rate is one you would accept in production.
  • Enforce on the narrowest high-consequence action set first.
  • Widen the enforced set as confidence accrues.

Frequently asked

What is monitor mode in AI governance?

A deployment mode where the governance layer evaluates and records policy verdicts without blocking anything. The calling application decides whether to act on the verdict, so the governance layer can never cause an outage.

Is monitor mode enough for compliance?

For evidence and oversight obligations, often yes — those require a demonstrable record, not prevention. For obligations that require preventing an outcome, no. Monitor mode records; it does not stop.

Why not just block from day one?

Because an untuned rule set blocking production traffic causes an outage, and one such incident usually ends the governance programme. Tuning against recorded real traffic first is slower to enforce and far more likely to reach enforcement at all.

Bulwark does this in production

Agent registry, scope enforcement, human approvals and a hash-chained evidence trail you can verify without trusting us. Free Developer tier, 100,000 governed decisions a month, no card required.

Related guides