Skip to main content
Shadow Enforcement, under Detect, answers one question: if these rules were armed, what would they have done to the actions your machines actually took? The page says so at the top: “Shadow enforcement — observing only” and “Decision on every one of these events is LOG_ONLY. Quint denied nothing.”

​
Reading the page

Pick a window; the page refreshes every 30 seconds. Verdicts over this window charts the same counts over time. Outside declared scope groups actions that fell outside what the agent declared, by capability, sensitivity or resource, with what the rule would have done. Policy rules matched lists each rule with how often it matched, in how many sessions, for how many agents and when last. Most recent is the live feed. CSV exports the window.

​
When the page is empty

“No shadow evaluations in this window.” means no evaluation data arrived for the window. That is not the same as every action being in scope. Check Coverage on the Overview and the Silent filter on Data Sources before reading an empty page as a clean one.

​
What arming changes

Arming turns the counterfactual into the real thing: a rule set to refuse refuses at the moment of the action, and a rule set to ask holds it for a person. Arming is one workspace switch, Enforcement, and only an Admin or Owner can change it. The switch appears in two places, Policies › Enforcement and Settings › Fleet › Enforcement mode. Both are the same control: turn it on in one and it is on in the other. While it is off, your own rules record and interrupt nothing. Turning it on. The switch asks first, in a confirmation titled “Turn enforcement on?”. It names the version your machines are served and the version they move to, for example “Your current rules (version 14) are re-signed as version 15 in enforce mode. The rules themselves don’t change.” Quint signs the rules it is serving now again, in enforce mode, as a new version. “This usually takes 1–3 minutes. Machines then pick it up within about a minute.” Meanwhile the switch reads turning on…. When the new version is live, the status reads “Enforcement is on.” and the machines that act on your rules start at their next check-in. If re-signing fails, the status under the switch says why and offers Retry now and Turn off. Turning it off. There is no confirmation: the switch turns off when you click it. “Machines stop refusing actions within about a minute.” Quint then re-signs your rules in shadow mode “so the record matches”. Turning it back on takes another 1–3 minutes. What the switch can’t promise.
  • “Machines on older Quint versions keep the setting but don’t stop anything.”
  • If a partner manages your workspace, the switch covers only the rules your organisation wrote. A partner’s rules in enforce mode can still refuse actions while your switch is off, and only the partner can change them. The page names the partner and how many machines hold its rules.
  • Quint can’t yet confirm that a machine is acting on its rules. What it reports is machines set to enforce: a machine counts when it reports holding rules signed in enforce mode and has checked in since the switch was last turned on. Every such count carries the note “Quint can’t yet confirm a machine is acting on it”.
Arming is a step you take together with your Quint contact. The switch covers every group of machines in your workspace at once, so arm with few rules set to Refuse or Ask for approval, keep the rest on Record, and widen from there.

​
What a developer sees when a rule is armed

A refused action is reported inside the agent with a line that starts with “Quint:”, for example:
A held action appears to the person at the machine as a macOS notification with Allow, Review and Deny. Held actions from workloads go to the Approvals inbox instead.

​
Before you arm: a checklist

  • The Would refuse rows for the last 14 days are actions you would in fact refuse. Spot-check them in the sessions they came from.
  • Would ask again is a volume your approvers can carry.
  • Every rule you keep has a reason a developer could read in a refusal.
  • Developers know whom to ask when a rule gets in their way.
  • Your Quint contact knows you are arming, and when.