Active Overrides
4. Active Overrides
Active Overrides is the emergency control panel for managing temporary exemptions, kill-switches, and policy bypasses. Overrides allow administrators to rapidly unblock legitimate use cases that are being incorrectly blocked by a guard, while maintaining a full audit trail.
4.1 Overrides Table
Active and historical overrides are listed with:
| Column | Description |
|---|---|
| Override ID | Unique identifier |
| Target | The specific tool, MCP server, domain, or guard being overridden |
| Type | The category of override applied |
| Status | active or expired |
| Expires | The timestamp when this override will automatically expire |
| Created By | The operator who created the override |
| Reason | The stated justification for the override |
4.2 Override Types
| Type | Effect |
|---|---|
| Allow Tool | Temporarily permits a specific tool that a guard has blocked |
| Allow MCP Server | Temporarily permits a specific MCP server connection |
| Allow Domain | Temporarily permits outbound calls to a blocked domain |
| Skip Guard Check | Bypasses a specific guard's evaluation for matching interactions |
| Global Exemption | Bypasses all active governance checks for matching interactions |
4.3 Creating an Override
Clicking Create Override opens a modal with the following fields:
- Override Type — Select from the five override types above
- Target — The specific resource to override (e.g., a tool name, MCP server slug, or domain)
- Duration — Choose from preset durations (1 hour, 6 hours, 24 hours, 7 days) or set a custom expiry date
- Severity Filter — Optionally limit the override to events at or below a specified severity level
- Scope — Apply the override tenant-wide (all guards) or to a specific guard only
- Reason — A mandatory justification for the override (used in audit logs)
4.4 Revoking Overrides
Any active override can be immediately revoked by clicking the revoke button (trash icon) on its row. Revocation takes effect immediately and is recorded in the Audit Logs.
RBAC: Creating overrides requires at minimum an
engineerrole. Certain override types may requireadminapproval depending on tenant configuration.