Glossary term

Audit-only mode

Policy enforcement mode that logs would-be blocks without actually denying execution — the standard way to validate a new policy.

Where Audit-only mode appears

intermediate

Policy that decides which executables, scripts, and installers are even allowed to run — enforced before the image loader finishes its job.