# Managing safeguards and controls in Paver

Safety mode and Paver Guard policies are two independent controls that give you precise governance over when and how IBM® Paver can make changes in your environment. Understand how they work together and choose a configuration that fits your task.

Safety mode determines whether Paver can make changes in your environment at all. Paver Guard policies then define the approval workflow for operations that are permitted. Understanding how these two controls interact lets you configure Paver to match the risk profile of any task.

## Safety mode

Safety mode is the feature that controls whether Paver can make changes in your environment during a session. Your environment includes anything outside the Paver sandbox, such as a VPC, a production database, or a cluster. With safety mode, you choose between two modes: Safe mode and Edit mode.

In Safe mode, Paver can't modify your environment or resources. It can still read and analyze your environment, and it can read and write files in the sandbox. This lets you explore safely and plan changes. For example, you can ask Paver to create a script or Terraform configuration that implements a plan. Paver can't run that script or apply that configuration in Safe mode, and it can't write outside the sandbox. If you ask for a change, Paver tells you that it can't perform the action because Safe mode is active. Guard policies have no effect in Safe mode because Paver can't make changes in your environment.

Edit mode allows Paver to make changes in your environment with approval. Switching to Edit mode does not give Paver a blank check though. It enables the approval workflow so that Paver can propose a tool call and wait for you to approve it before running.

Switch between Safe mode and Edit mode by using slash commands in `paver chat`:

```text
/safe
/edit
```

## Paver Guard policies

Paver Guard policies control the approval behavior for operations that are permitted in the current mode. You set a policy by using the `/guard` slash command in `paver chat` or the `--guard` flag with `paver ask`.

| Policy                | Behavior                                                                                                                                                                                                                  |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `auto-approve-low`    | Low-risk operations run automatically. Medium and high-risk operations prompt for `y/n` approval.                                                                                                                         |
| `auto-approve-medium` | Low and medium-risk operations run automatically. Only high-risk operations require manual approval.                                                                                                                      |
| `auto-deny-medium`    | Paver automatically denies its first attempt at a medium or high-risk operation and tries another approach. If Paver can't find another approach after several attempts, it asks you for permission to run the operation. |
| `auto-deny-high`      | Paver automatically denies its first attempt at a high-risk operation and tries another approach. If Paver can't find another approach after several attempts, it asks you for permission to run the operation.           |
| `no-auto-approval`    | Requires approval for all operations.                                                                                                                                                                                     |
| `todo`                | Set to-do list auto-approvals to `smart` (auto-approve status updates, but require approval for add and delete), `true` (auto-approve all todo operations), or `false` (require approval for all todo operations).        |

Auto-deny policies steer Paver toward lower-risk approaches. They don't permanently block operations. To completely block operations that make changes in your environment, use Safe mode.

Set a policy from an interactive chat:

```text
/guard auto-approve-medium
```

Set a policy from the CLI:

```text
paver ask "scale my worker pool to 5 nodes" --guard auto-approve-medium
```

## How modes and policies interact

Paver evaluates the mode and the Paver Guard policy in sequence. The mode is evaluated first. If safe mode blocks the operation, the guard policy is never consulted.

| Mode | Guard policy          | Result                                                                                                                                         |
| ---- | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| Safe | Any                   | Blocked. Operations that make changes in your environment are disabled regardless of the guard policy.                                         |
| Edit | `no-auto-approval`    | Restricted. Paver requires approval for all operations.                                                                                        |
| Edit | `auto-approve-low`    | Hybrid. Low-risk changes are automatic. Medium- and high-risk changes prompt for `y/n`.                                                        |
| Edit | `auto-approve-medium` | Balanced. Low- and medium-risk changes are automatic. Only high-risk changes prompt for `y/n`.                                                 |
| Edit | `auto-deny-medium`    | Cautious. Paver denies its first attempt at medium and high-risk changes and tries another approach. If it can't, it asks for your permission. |
| Edit | `auto-deny-high`      | Restricted. Paver denies its first attempt at high-risk changes and tries another approach. If it can't, it asks for your permission.          |

## Common configurations

The following configurations match common operational scenarios. Each scenario pairs a mode with a guard policy to achieve a specific risk profile.

### Exploration and planning

**Scenario:** You are investigating a production account that you have not worked in before, such as auditing resources, tracing a bug, or reviewing the current state before planning changes.

**Configuration:** `/safe`

In Safe mode, Paver can't make changes in your environment, regardless of what you ask. You can explore freely and ask Paver to draft scripts or Terraform for the changes that you plan to make because Paver can read and write files in the sandbox. Because Paver can't make changes in your environment in Safe mode, no guard policy is needed.

### Routine maintenance

**Scenario:** You are performing repetitive, well-understood changes, such as updating environment variables on app instances, scaling a worker pool, or applying a configuration update. You want to reduce the interruption of approving each low-risk step manually.

**Configuration:** `/edit` with `/guard auto-approve-medium`

Low- and medium-risk operations run automatically, removing the `y/n` prompt for routine work. If Paver determines that the best resolution requires a high-risk action, such as replacing a VPC, Paver Guard pauses and requires manual approval before proceeding.

### Steering Paver away from high-risk operations

**Scenario:** You want Paver to avoid high-risk operations, such as deleting a production cluster, whenever a safer approach exists.

**Configuration:** `/edit` with `/guard auto-deny-high`

Paver makes low- and medium-risk changes as the policy allows. When Paver first attempts a high-risk operation, Paver Guard denies it and instructs Paver to find another way. If Paver can't find another way after several attempts, it asks you for permission to run the high-risk operation. Use `auto-deny-medium` to apply the same behavior to medium-risk operations.

## Restricting what Paver can do

Paver acts with your permissions. If you don't want something in your environment to be changed, don't rely on Paver settings alone. Use the access controls of the host offering as the ultimate safeguard. If a user can't perform an action, they can't perform it by using Paver either.

## Quick reference

| Goal                       | Mode    | Paver Guard policy    | Risk profile                                                                                |
| -------------------------- | ------- | --------------------- | ------------------------------------------------------------------------------------------- |
| Audit, explore, or plan    | `/safe` | Not applicable        | No changes are allowed in your environment, but files can be written in the sandbox.        |
| Routine operations         | `/edit` | `auto-approve-medium` | Balanced; high-risk still requires approval                                                 |
| Avoid high-risk operations | `/edit` | `auto-deny-high`      | High-risk first attempts are denied; Paver tries another approach, then asks for permission |