title: Upgrade to enforce mode description: Seven-step playbook from gap review through What-If impact-preview, promote, sandbox test, OPAL verify, production promote, and post-enforce checks. audience: Platform engineers and compliance officers timeEstimate: 45 minutes prerequisites:

Gap report accepted by compliance stakeholders
Candidate controls generated or authored
Enforce-capable license available

Upgrade to enforce mode

Graduate from shadow discovery to inline enforcement with a controlled 7-step playbook. Same universal Bouncer image — only mode, license, and activated controls change.

Seven-step playbook

Step 1 — Review gaps (~10 min)

Open Gap report and Compliance report.

Critical / high gaps triaged (remediate, accept, or defer)
CANNOT_ASSESS items have PIP plan or documented out-of-scope
Executive sign-off recorded

Step 2 — What-If impact-preview (~5 min)

Estimate blast radius before promoting candidates:

curl -X POST "$PAP_API/v1/compliance/impact-preview" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"environment":"sandbox","control_ids":["<candidate_id>"],"window_hours":168}'

UI: Compliance & Gaps → What-If / Impact preview (or Policy Impact Simulator for authored controls).

would_block_percent acceptable for change window
Unexpected high-volume paths reviewed

Step 3 — Promote candidate control (~5 min)

Promote the generated/authored control into sandbox (not production yet).

UI: Controls → Promotion / PolicyPromotion (uses the real promote API).

Control version/commit recorded
Bound to correct protected resources / environment = sandbox

Step 4 — Sandbox enforce test (~10 min)

helm upgrade controlcore ./cc-infra/helm-chart/controlcore -f values.yaml \
  --set bouncerSandbox.enforcementMode=enforce
# Or remove values-shadow.yaml overlay for sandbox only

Negative test receives deny/mask (403 or redacted body as designed)
Positive / public paths still succeed (no activation tax)
Policy Impact Simulator agrees with live sandbox results

Step 5 — Verify OPAL sync (~5 min)

curl -s "$PAP_API/health/opal-bridge" -H "Authorization: Bearer $TOKEN" | jq .
# Expect OPAL_SYNC_COMPLETED for sandbox bouncer; pending_in_progress_sync_rows == 0

Bundle hash on Bouncer matches Control Plane
No stuck in_progress sync rows

Step 6 — Promote to production (~5 min)

Apply enforce-capable license (Settings → License), then roll production Bouncers during the change window:

helm upgrade controlcore ./cc-infra/helm-chart/controlcore -f values.yaml \
  --set bouncerProduction.enforcementMode=enforce

Promote the same control version to production environment bindings.

License shows enforce entitlement
Application owners notified
Rollback plan ready (deactivate control → optional return to shadow)

Step 7 — Post-enforce verification (~5 min)

Audit shows DENY / mask events (not only SHADOW_WOULD_*) for intended paths
Error budgets / p99 latency within SLO
Compliance dashboard gap trend improving or stable
Export post-enforce evidence (Compliance report)

Click to enlarge

Pre-enforcement checklist (summary)

Steps 1–7 complete
Critical gaps remediated or accepted with compensating controls
Sandbox Bouncer validated with BOUNCER_ENFORCEMENT_MODE=enforce
Change window communicated

Apply enforce-capable license

Obtain license key from Control Core Business Admin (enforce entitlement + expiry).
Apply in Settings → License.
Confirm status shows enforce entitlement when required.

Troubleshooting: If production breaks after enforce, deactivate the new control first (returns to pass-through for that scope), then optionally roll the Bouncer back to shadow while investigating. License expiry blocks authoring only — traffic and audit continue. See Troubleshooting.