Operate Veefore

Running it, watching it, and knowing what to do when something is wrong.

This section is for whoever is on call. It assumes your agents are enforcing, and that at some point something will need attention.

On hosted Veefore, running the service is ours: skip straight to Watching it. The controls, runbooks and daily rhythm below apply to everyone. The next section is for self-hosted installs.

#Running it

Run the stack

Three processes, what each does, health endpoints, scaling.

Configuration

The settings that matter and the ones that will bite you.

Database

Migrations, pooling, row-level security, backups.

Deployment

Containers, Kubernetes, and the rollout order.

#Watching it

Observability

Metrics, traces, logs, and what to actually alert on.

Console tour

Every page and the question it answers.

Risk Center

Reading the distribution and tuning from evidence.

Approvals queue

The thing most likely to rot if nobody owns it.

#When something is wrong

Symptom	Start here
An agent is doing something it should not	Compromised agent
A policy activation broke things	Policy rollback
A credential has leaked	Credential leak
Everything is returning `503`	Dependency outage
Something else	Troubleshooting

#The four controls worth memorising

bash
# Stop one agent. Reversible. Immediate.
curl -X POST $CP/v1/agents/agt_01ABC/pause \
  -H "Authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{ "reason": "Investigating anomalous volume" }'

# Stop everything in an environment. Reversible. Immediate.
curl -X POST $CP/v1/environments/env_01ABC/pause \
  -H "Authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{ "reason": "Investigating anomalous volume" }'

# Disable one tool for every agent. Reversible. Immediate.
curl -X POST $CP/v1/tools/tool_01ABC/disable \
  -H "Authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{ "reason": "Downstream returning bad data" }'

# Kill an identity. TERMINAL. Requires step-up.
veefore agents revoke agt_01ABC --reason "Key suspected compromised"

Pause. Do not drop the enforcement mode.

Under pressure the instinct is to put the environment back in OBSERVE. That is the worst available option: it stops refusing anything while leaving everything running, so a misbehaving agent gets a free pass at exactly the wrong moment.

Pause the environment, or pause the agent. Then diagnose.

#Two things that are the design, not a bug

A dependency outage refuses protected actions. If policy evaluation or identity verification is unavailable, agents get a 503 and stop. There is no mode in which an error becomes an allow. See Fail closed and Dependency outage.

Revocation is terminal. There is no un-revoke. Use pause for anything you might want to undo.

#Daily rhythm

A short version of Operate it:

Work the approval queue.
Scan the Security Center for CRITICAL events and open incidents.
Check refusal volume. A change in either direction is information.
Weekly: veefore doctor --strict, veefore audit verify, review the Risk Center.