Enforcement Mode

Every Trappr app operates in one of two modes: MONITOR (observe and log all activity) or ENFORCE (actively block requests that violate your security policies). Start with MONITOR to tune your policies, then graduate to ENFORCE when you're confident.

MONITOR mode

In MONITOR mode, Trappr observes all traffic and logs every event — DLP matches, canary triggers, policy violations — but never blocks a request. Your agent continues operating normally, and you gain full visibility into what it's doing.

MONITOR mode is the default for all new apps. Use it to:

Establish a behavioral baseline during the Discover phase
Tune DLP patterns to eliminate false positives before enforcement
Understand your agent's traffic patterns before restricting them
Test alert routing without risking production disruption

We recommend running MONITOR mode for at least 24–48 hours before switching to ENFORCE. Review the DLP and incident logs to see what would have been blocked.

ENFORCE mode

In ENFORCE mode, Trappr actively intercepts requests that violate your policies. Depending on the violation type, the response is blocked and your agent receives a policy error response.

Violation type	MONITOR behavior	ENFORCE behavior
DLP match	Log event, forward request with masked values	Block request entirely (configurable per category)
Canary token triggered	Log incident, fire alert	Log incident, fire alert, block response
Disallowed model	Log event, forward to requested model	Block request, return policy error
Agent tampered	Log event, fire alert	Deactivate agent key, block all requests

Error response format

When ENFORCE mode blocks a request, your agent receives a structured error:

JSON

{
  "error": {
    "type":    "trappr_enforcement",
    "code":    "policy_violation",
    "message": "Request blocked by Trappr security policy.",
    "details": {
      "violation": "dlp_match",
      "category":  "credentials",
      "appId":     "app_XXXX"
    }
  }
}

Your agent should handle this error gracefully — for example, logging the block and halting the workflow.

Python

try:
    response = client.chat.completions.create(
        model="gpt-4o",
        messages=[...],
    )
except openai.BadRequestError as e:
    error = e.response.json().get("error", {})
    if error.get("type") == "trappr_enforcement":
        # Policy violation — halt gracefully
        logger.warning("Request blocked: %s", error.get("code"))
        return None

Switching modes

Mode is configured per-app (not per-agent). To switch:

Go to Dashboard → Apps → [Your app]

Select the app you want to configure.

Click "Enforcement mode" in the app settings

Toggle between MONITOR and ENFORCE. The change takes effect immediately for all new requests.

Verify in the gateway logs

After switching to ENFORCE, trigger a request you know should be blocked (e.g. send a test email address if you have DLP/PII enabled). Confirm the request was blocked in Gateway → Logs.

Switching to ENFORCE mode in production without testing first can break your agent workflows. Always test in a staging environment or use a separate Trappr app for production vs. staging.

Per-category enforcement

Within ENFORCE mode, you can control which DLP categories block vs. mask. For example: block on Credentials matches (an API key in a prompt is almost always a security error) but only mask on PII (your agent may legitimately need to process customer data).

Configure this under Dashboard → DLP → [Category] → On match: Block / Mask.

← PreviousExecution Tracking Next →n8n Integration