Guide: enforced mode

Enforced is the strictest accountability mode. Passport TTL ties to the checkpoint interval. Critical detector results can block a request. A critical event can also block new Passport issuance when on_critical is set to block. Any delegation must preserve the mode.

Fleet agents always use enforced mode and proxy-only credential access. A policy can authorize routine work automatically while retaining those protections. A rule marked review requires human approval of the exact action before dispatch.

1. Enable on an agent

curl -X PATCH https://api.getstack.run/v1/agents/agt_support_bot \
  -H "Authorization: Bearer $STACK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "accountability_mode": "enforced" }'

2. TTL ties to checkpoint interval

At issue, an enforced agent's signed Passport expires after one checkpoint interval. ttl_seconds is ignored. The interval is checkpoint_interval_seconds from the request, or 5 minutes when it is omitted. Refresh and delegation take the smaller of ttl_seconds and the interval. The Mission, a fleet deadline and the identity lease can shorten any of these. Standard and logged agents use ttl_seconds, 15 minutes by default.

issue:             ttl_actual = checkpoint_interval_seconds
refresh, delegate: ttl_actual = min(ttl_seconds, checkpoint_interval_seconds)

Presets:

• frequent - 2 minutes (high-risk, real-money paths)
• standard - 5 minutes (default)
• relaxed - 15 minutes (long-running but still monitored)
• marathon - 60 minutes (batch jobs)

3. Submit checkpoints and refresh the token

A checkpoint records progress and advances the stored monitoring deadline. It returns new_expires_at. It does not change the signed JWT exp or return a new token. Refresh the Passport to continue beyond the current token expiry.

curl -X POST https://api.getstack.run/v1/passports/pas_8f3a/checkpoint \
  -H "Authorization: Bearer $STACK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "services_used": ["slack"],
    "actions_count": 2,
    "summary": "Fetched ticket context"
  }'

4. Detector enforcement

An enforced critical detector result can block the current request. A recorded critical event can block future Passport issuance when on_critical is block. The scope_drift path is different. It revokes the active Passport in enforced mode and cascades to delegated children.

scope_drift fires in enforced mode
  -> record a security event
  -> revoke the active Passport and delegated children
  -> reject the next STACK-verified call

5. Delegation cannot drop the mode

An enforced parent cannot delegate to a child whose agent is inlogged or standard. The delegate call throws DELEGATION_ACCOUNTABILITY_VIOLATION and fires adelegation_downgrade security event at critical severity.

6. Checkout review is stricter

Enforced mode keeps the full set of checkout flags. Logged mode keeps only critical flags. A critical flag blocks future Passport issuance only when on_critical is block. A warning blocks only when on_warning is block.

Signals enforced mode raises

• checkpoint_silence - more than two intervals without a checkpoint
• credential_burst - credential retrievals above threshold
• credential_after_checkout - activity after checkout was submitted
• scope_drift - behavioral drift from declared intent; auto-revokes on fire
• delegation_without_intent - delegation when intent.will_delegate was not set
• delegation_downgrade - child agent is in a looser mode
• unauthorized_skill_access - skill outside skill_access_mode

Related

• /docs/guides/passport-lifecycle - full issue → checkpoint → checkout → review flow
• /docs/concepts/detectors - full detector catalog and auto-revoke rules
• /docs/concepts/revocation - online checks and cascade behavior