Watching first

A rule with no mode is in observe. The call runs, the verdict is recorded, and nothing about the run changes. This is the default because a rule you have just written is a hypothesis about your agent, and switching it on before you have watched it is how a guardrail becomes an outage.

const SAFE_01 = {
  id: 'SAFE-01',
  description: 'purgeLogs never runs',
  formula: LTL.always(LTL.not(P.toolCall('purgeLogs'))),
  mode: 'observe' as const,
}

SAFE-01 is only watching, so purgeLogs runs and the violation is recorded against it. Under deny the call would have been refused and this trace would not contain it at all.

What observing buys you

A verdict per interception, including the ones that would have been stopped. onDecision fires whether the action was observe or deny, so a rule in observe tells you exactly how often it would have fired, against real traffic, before it can hurt anything.

Traces worth keeping. A refused call leaves no event — it never happened. So the only runs that contain the behaviour a rule is about are the ones recorded while that rule was watching. Those are the fixtures your rule-regression corpus is built from, and there is no way to collect them after enforcement is on.

What it costs

The obvious thing: the call runs. observe is a measurement, not a guardrail, and a rule left in observe because nobody came back to it is a rule that is documenting incidents rather than preventing them.

The useful discipline is to treat the mode as a lifecycle. A rule is written in observe, watched against real runs until its false-positive rate is known, and then switched to deny, suspend or abort — at which point its recorded traces become the regression suite that tells you a later edit to the rule still catches what it caught.

The four modes

Mode	At the interception point	Reach for it when
observe	The call runs; the verdict is recorded.	The rule is new and has to earn trust.
deny	The call is refused; the violation is returned as the tool’s result.	The agent could reasonably do something else instead.
suspend	The workflow pauses through its own suspension; a human’s answer resumes it.	A person has to decide, and may take a while.
abort	The run is cancelled and the guard throws where the side effect would have been.	Nothing downstream should happen and nobody will be asked.

Enforcement modes has the whole picture, including what happens when one event breaks several rules with different modes at once.