> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rotascale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The enforcement ladder

> Observe, shadow, canary, enforce. Enforcement is a mode on a grant, it moves one rung at a time, and the mode is sealed into every record.

Nobody switches a production estate from nothing to blocking in one step, so the
platform does not ask. Enforcement is a **mode on a grant**, not a global
setting, and each grant moves independently when the team that owns it agrees.

<Steps>
  <Step title="observe">
    The check runs and records what it *would* have done. Nothing is refused,
    nothing changes. Zero operational risk, and after a fortnight you know what
    your agents are actually doing rather than what the design document says.
  </Step>

  <Step title="shadow">
    The full decision path is exercised, including policy evaluation, and still
    nothing is refused. You can also pass `incumbent_decision`, which is what
    your existing system or reviewer decided, and the divergence is the point.
    Where they disagree is where the policy is wrong.
  </Step>

  <Step title="canary">
    Refusals begin, on a subset. This is the first rung where an agent can
    actually be stopped.
  </Step>

  <Step title="enforce">
    Refusals apply to everything under this grant.
  </Step>
</Steps>

The first two rungs are free. The commercial line sits where refusals begin to
bite, which is the honest place to put it: see
[pricing](https://rotascale.com/pricing/).

## The mode is part of the record

This is the part that matters eighteen months later. The enforcement mode is
sealed into each decision **at the moment it was made**, so an evidence pack
states what was enforcing *then* rather than what is configured now.

<Warning>
  A system that reads the mode from current configuration when producing evidence
  is reconstructing, not recording. Configuration drifts: a limit raised for a
  migration in March and never lowered is the most ordinary finding there is.
</Warning>

## Seeing all four at once

The demo runs the same agent at three rungs simultaneously, and the records
differ exactly as the ladder claims: the `observe` and `canary` copies refunded
the same tickets and recorded `enforced: false`; the `enforce` copy refused and
escalated.

That is the argument for shipping this without a flag day, and it is
[observable](https://demo.rotascale.com/trajectories) rather than asserted.

## Moving a grant

See [Move up the ladder](/guides/move-up-the-ladder) for the call and what to
watch while you do it.