Protection states, from observation to enforcement
What Observe, Shadow and Enforcing mean, which gates sit between them and how you move safely in both directions.
You know exactly what changes for visitors in each protection state.
Observe
Traffic is measured; nothing changes for visitors. Inventory, threat relevance and traffic telemetry accumulate so every later decision has evidence.
Shadow
Candidate rules run against real traffic without blocking anything. You see exactly what would have been flagged, and false positives cost nothing.
Enforcing
Bounded controls may act - always scoped, always with a TTL, always with a rehearsed rollback. Enforcement requires explicit gates to pass first: certificate issued, origin stability window, health checks, rollback proof. Autonomous blanket blocking does not exist in AegiFlow.
Moving between states
Transitions are explicit operator decisions and work in both directions. Returning to Observe is always available and never gated.
Verification
- You can list the gates required before enforcement
- You know how to return to a previous state