---
title: Operate Veefore
description: Running it, watching it, and knowing what to do when something is wrong.
label: Overview
---

This section is for whoever is on call. It assumes your agents are enforcing,
and that at some point something will need attention.

On hosted Veefore, running the service is ours: skip straight to
[Watching it](#watching-it). The controls, runbooks and daily rhythm below
apply to everyone. The next section is for self-hosted installs.

## Running it

:::cards

:::card Run the stack | /operate/run-the-stack | ⬒
Three processes, what each does, health endpoints, scaling.
:::

:::card Configuration | /operate/configuration | ⚙
The settings that matter and the ones that will bite you.
:::

:::card Database | /operate/database | ⛁
Migrations, pooling, row-level security, backups.
:::

:::card Deployment | /operate/deployment | ⇡
Containers, Kubernetes, and the rollout order.
:::

:::

## Watching it

:::cards

:::card Observability | /operate/observability
Metrics, traces, logs, and what to actually alert on.
:::

:::card Console tour | /operate/console-tour
Every page and the question it answers.
:::

:::card Risk Center | /operate/risk-center
Reading the distribution and tuning from evidence.
:::

:::card Approvals queue | /operate/approvals-queue
The thing most likely to rot if nobody owns it.
:::

:::

## When something is wrong

| Symptom | Start here |
| --- | --- |
| An agent is doing something it should not | [Compromised agent](/operate/runbook-compromised-agent) |
| A policy activation broke things | [Policy rollback](/operate/runbook-policy-rollback) |
| A credential has leaked | [Credential leak](/operate/runbook-credential-leak) |
| Everything is returning `503` | [Dependency outage](/operate/runbook-dependency-outage) |
| Something else | [Troubleshooting](/operate/troubleshooting) |

## The four controls worth memorising

```bash
# Stop one agent. Reversible. Immediate.
curl -X POST $CP/v1/agents/agt_01ABC/pause \
  -H "Authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{ "reason": "Investigating anomalous volume" }'

# Stop everything in an environment. Reversible. Immediate.
curl -X POST $CP/v1/environments/env_01ABC/pause \
  -H "Authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{ "reason": "Investigating anomalous volume" }'

# Disable one tool for every agent. Reversible. Immediate.
curl -X POST $CP/v1/tools/tool_01ABC/disable \
  -H "Authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{ "reason": "Downstream returning bad data" }'

# Kill an identity. TERMINAL. Requires step-up.
veefore agents revoke agt_01ABC --reason "Key suspected compromised"
```

:::danger Pause. Do not drop the enforcement mode.
Under pressure the instinct is to put the environment back in `OBSERVE`. That is
the worst available option: it stops refusing anything while leaving everything
running, so a misbehaving agent gets a free pass at exactly the wrong moment.

Pause the environment, or pause the agent. Then diagnose.
:::

## Two things that are the design, not a bug

**A dependency outage refuses protected actions.** If policy evaluation or
identity verification is unavailable, agents get a `503` and stop. There is no
mode in which an error becomes an allow. See
[Fail closed](/secure/fail-closed) and
[Dependency outage](/operate/runbook-dependency-outage).

**Revocation is terminal.** There is no un-revoke. Use `pause` for anything you
might want to undo.

## Daily rhythm

A short version of [Operate it](/journey/operate):

- Work the approval queue.
- Scan the Security Center for `CRITICAL` events and open incidents.
- Check refusal volume. A change in either direction is information.
- Weekly: `veefore doctor --strict`, `veefore audit verify`, review the Risk Center.