Docs

Roll out without stopping anyone yet

Install everywhere, watch for a week, and only then start blocking. Nothing is stopped until you say so.

What a fresh workspace does

Records everything. Blocks only things you've blocked by hand in the Inventory, and an AI tool trying to turn ZYBE off. Every other built-in rule is on and set to Report. Developers notice nothing.

The safe order

  1. Install everywhere. See Roll out to the whole company.
  2. Watch Detections for a week. You'll see which rules would have fired, how often, and for whom. The ones that fire on honest work are the ones to set to Ask rather than Block.
  3. Fix the Issues that are easy. Keys in shell profiles, agents far behind their release, MCP servers with keys in plain text.
  4. Turn on Block for the clear ones. Credential reads, pipe to shell, destructive commands, action after injection. See Stop dangerous commands.
  5. Turn on Ask for the rest. sudo, installs from a URL.
  6. Tell people. One message: ZYBE is on, here's what it stops, here's how to ask for an exception.

The pause switch

If you need to stop everything at once without touching rules: click the gear icon, then Rules, open Advanced, and switch on Pause all enforcement. Every Ask and Block becomes Report, everywhere, until you switch it off. Detections keep arriving so you still see what would have been stopped.

Start with one team

Make a group for the pilot team and a profile with blocking on, scoped to that group. Everyone else stays on the Default, which only reports. See Different rules for different teams.

Or one AI tool

Make a profile scoped to Claude Code only, with blocking on. See Different rules for different AI tools.