Skip to main content
The execution policy is the contract that bounds what Auto mode may do. It is deny-by-default in every dimension: a new tenant’s policy is empty, and an empty or incomplete policy means nothing auto-executes, even with the autonomy dial at Auto. You edit the policy in the dashboard - the Execution policy (Auto mode) card sits directly under the autonomy dial on the Incidents view - or via GET/POST /api/settings/execution-policy. The card always shows a plain-language summary of the net effect, for example:
Auto mode may apply manifest patches in production, payments at high+ confidence, up to 5/hour.
or, when the policy is incomplete:
Nothing auto-executes - Auto mode requires a complete policy (namespaces, fix types, confidence floor, hourly cap).

​
Policy dimensions

​
When the policy is evaluated

The policy is not a one-time gate. It is enforced at two points:
  1. Queue time - when analysis completes at Auto, the controller checks every dimension before creating an approved remediation attributed to agent-policy. Anything outside policy is created as proposed for a human instead.
  2. Serve time - when the in-cluster executor asks for work, the controller re-evaluates the current policy. If the policy no longer covers a queued remediation (you removed the namespace, disabled the fix type), the approval is demoted and the work is not served. Tightening the policy takes effect immediately, including for work already in the queue.
Rollbacks are subject to the same policy: a policy-approved original only rolls back automatically if the current policy still allows it - otherwise the rollback waits for a human with a rollback_policy_denied audit event. See Compensating actions.

​
Interaction with hard safety limits

The policy is a tenant-configurable envelope inside platform-level guarantees that you cannot accidentally disable:
  • Every manifest patch is validated server-side against a field allowlist (resource limits and requests, replicas, environment variables, probe tuning, and similar operational fields). Patches touching identity or metadata are rejected outright, no matter what the policy says.
  • The executor’s own RBAC is namespace-scoped at install time, so even a maximally permissive policy cannot reach namespaces you never granted.
  • Concurrent remediations for the same workload are refused (HTTP 409) while one is in flight.
Treat the namespace allowlist as your primary blast-radius control and start narrow: one non-critical namespace, high confidence, a low hourly cap. Widen it only after you have watched the audit trail for a while and trust what you see.