Docs
Monitor mode for safe rollout.
Monitor mode evaluates policy decisions and writes logs without blocking the underlying action. Use it while onboarding agents and tuning policies.
When to use monitor mode
Use monitor mode during initial setup, design partner testing, and policy tuning. It shows what would have been allowed or denied without interrupting active agent workflows.
Example log event
In this example, a risky action is evaluated as denied by policy, but the workspace is still in monitor mode, so the call is logged and allowed through.
{
"agent": "codex-dev",
"action": "create_pr",
"resource": "acme/app",
"evaluatedDecision": "deny",
"enforced": false,
"outcome": "allowed_in_monitor_mode"
}Move toward enforcement
Review denied-in-monitor events first. If the denial is expected, keep the rule and move that action into enforce mode. If the denial is a false positive, adjust the matching scope before enabling enforcement.
Quota behavior
Monitor calls count against the workspace tool-call limits for the active plan. Enforce-specific quotas do not apply while the workspace is configured for monitor mode, but the dashboard still shows enforce usage before you switch modes.