> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# How policies work

> Rulesets and alerts, the matches between them, why every rule starts in shadow mode, and what happened to watch profiles.

Policies in Quint are two things, and the evidence between them. **Rulesets** say what your machines should notice. **Alerts** tell people what the rules noticed: when a rule refuses an action, when a threshold is crossed, or on a schedule. Both work from **matches**. The **Policies** page is a hub: a chart of your matches and a card for each section, each opening its own page. **Rules** is "The rules your machines run, and what each one matched." **Caught actions** is "Every agent action a rule noticed, newest first." **Versions** is "Every published version of your rules." **Enforcement** is "Whether rules can refuse actions on your machines, and what turning it on changes." **Alerts & incidents** is "Who is told when a rule matches, and when an incident opens."

## Rulesets

A ruleset (also called a policy pack) is a versioned, signed set of rules. Each rule is one disposition over conditions:

* The disposition is what the rule wants: **record**, **ask** or **refuse**.
* The conditions name what the rule is about, across up to six kinds of matcher. All kinds you fill in must match. Within one kind, any one value is enough.

A ruleset has a review-and-publish step. Each published version gets a **serial**. Machines receive the published serial.

## Matches

When a rule's conditions fit an action, the dashboard records a **match**. A match means a rule noticed the action. It is evidence for you to read, not a judgement that the action was wrong.

## Alerts

The **Alerts** tab holds only what your rules send. The refused-action alert tells your channels when an armed rule refuses an action, and opens an Incident. A scheduled summary (recap) sends counts and rule names to a Slack, Teams or alert-webhook destination you already set up on **Integrations**. A summary can carry match thresholds, which send a message when refuse matches reach a number you set within a fixed UTC window. Each shows the channels it is sent to; channels are turned on and off on **Integrations**. An alert tells a person something; it never changes what a machine does. See [Alerts](https://docs.quintai.dev/policies/notifications.md).

The three built-in alerts that do not come from a rule (divergence, unusual activity and the risk score limit) are on [Settings › Notifications](https://docs.quintai.dev/settings/notifications.md#built-in-alerts).

## Shadow mode first

Every ruleset starts in shadow mode. In shadow mode a rule only records. The **Shadow Enforcement** page then shows you, against the real traffic of the last 14 days, what each rule would have done: "would have asked", "would have refused". Nothing is interrupted.

You arm your rules when the shadow results look right. Arming is one workspace switch, **Enforcement**, which an owner or admin turns on. The switch sets the mode of the ruleset your machines are served by re-signing it: turning it on signs your current rules again in enforce mode, as a new version, and turning it off signs them again in shadow mode. The rules themselves don't change. While the switch is off, your own rules record and nothing else.

> [!NOTE]
>
> Arming enforcement is a step you take together with your Quint contact. Read [Shadow enforcement](https://docs.quintai.dev/policies/shadow-enforcement.md) first.

## What happened to watch profiles

The **Profiles** tab was retired. Sensitive-path settings an organisation already declared remain active and continue to reach its machines. The dashboard no longer shows or edits them; an administrator can inspect or change them through the API. Everything else a profile held never changed what a machine did.

## Where to go next

* [Write and publish a rule](https://docs.quintai.dev/policies/write-and-publish-a-rule.md)
* [Alerts: refused actions, match thresholds and summaries](https://docs.quintai.dev/policies/notifications.md)
* [Shadow enforcement](https://docs.quintai.dev/policies/shadow-enforcement.md)
* [Decide an approval](https://docs.quintai.dev/dashboard/decide-an-approval.md), for what happens when an armed rule says "ask"


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.