Switch a workload to Enforce

Task

Enforce is a mode switch on a registered workload. There's no revision to pin and no admission to request. You preview the calls that Enforce would block, confirm, and switch. Switching back to Audit needs no preview.

Self-managed installations only

Workload Trust is available only in private, self-managed AIControls installations, on premises or in a cloud cluster that you run. It needs a dedicated cluster that you run, with Kyverno, Kyverno Runtime, and cluster OIDC and RBAC access in place. Nirmata-hosted (SaaS) workspaces don't include it. See Feature availability.

Before you begin

• You need an administrator session.
• The workload needs a registration with a bound, Pod-bound identity. See Bind a workload identity.
• The workload needs an effective grant: an enabled, allow-mode Access Binding, the Blueprint's or one the workload's override references, with at least one server, tool selector, Toolset reference, or model selector. Without a grant, Enforce would allow nothing beyond the default access policy, so AIControls refuses the switch.

Switch to Enforce

1. Open the workload's detail page and select the AI access tab.
2. On the Mode card, select Enforce in the Audit and Enforce switch. AIControls previews the change first.
3. Read the Switch to Enforce? dialog. It says how many of the workload's calls in the last seven days matched no grant, and that Enforce would block calls like them. Promote the ones the workload needs before you switch. See Promote a recommendation.
4. Select Switch to Enforce. The workload runs in Enforce from its next call.

If the workload changes after you preview, AIControls refuses the switch with 409 preview_stale. Select Enforce again to preview again.

Switch back to Audit

On the Mode card, select Audit, and then confirm Switch to Audit?. Switching to Audit needs no preview.

What changes in Enforce

In Enforce, the workload's blocks apply, and a call that no referenced Access Binding grants follows the workload unmatched action. See Access modes. The runtime enforcement of the workload's network, files, and programs is a separate control. See Enable enforcement for a workload.

Because bindings are live, an edit to the workload's Access Binding reaches an Enforce workload at once. The impact preview tells you when an edit gives Enforce workloads new access, or leaves them with none.

Use the API

Preview the switch, then send it with the preview's hash:

curl -X POST "https://YOUR_WORKSPACE_URL/api/v1/workloads/production/Deployment/pr-review-agent/mode/preview?cluster=$CLUSTER_UID" \
  -H "Authorization: Bearer $AICONTROLS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode": "enforce"}'

curl -X POST "https://YOUR_WORKSPACE_URL/api/v1/workloads/production/Deployment/pr-review-agent/mode?cluster=$CLUSTER_UID" \
  -H "Authorization: Bearer $AICONTROLS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode": "enforce", "previewHash": "PREVIEW_HASH", "expectedRowVersion": 7, "rowToken": "ROW_TOKEN"}'

Read expectedRowVersion and rowToken from registration.rowVersion and registration.rowToken in GET /api/v1/workloads/{namespace}/{kind}/{name}/access?cluster=$CLUSTER_UID. Both are required, for Audit as well.

PUT .../access can't enter Enforce. It returns 409 mode_switch_required.

code	Cause
enforce_no_grant	The workload has no effective grant.
enforce_ineligible	The workload's identity binding is missing, stale, or ambiguous. It needs a coherent Pod-bound identity.
preview_stale	The workload changed after the preview. Preview again.
conflict	The expectedRowVersion or rowToken is stale. Read the access again and retry.
mode_switch_required	A PUT .../access request tried to set Enforce. Use the mode route.

Each switch records a workload_registration.mode_changed event in the configuration audit.

Related

• Workload access
• Register a workload