Runbook: simulate before enforce

Rolling a blocking policy across a fleet without evidence is how you break everyone's workflow at once. Policy lets you simulate a rule against real traffic org-wide first, see what it would have blocked, and only then enforce.

The flow

1. Draft - write the rule. It does nothing yet.
2. Simulate - the rule scores real traffic across the fleet and logs would-block events, redacted to metadata. No request is stopped.
3. Review - read the would-block report. False positives here would become real blocks; tune until it's right.
4. Enforce - promote the rule. Matching traffic is now blocked, fail-closed.

Why simulate is not optional

Guard's single-machine flow is the same idea - see Simulate, then enforce a policy. At fleet scale the stakes are higher: one over-broad rule can halt every developer. Simulation turns that risk into a report you read before anything changes.