Practice mode, approvals and safety limits

Three ways to run

• Practice only: records what it would have done and changes nothing. Use it the first time.
• Ask before running: waits for a person to approve. The approvers are emailed a link, and the run expires if nobody approves in time.
• Run automatically: acts straight away. Choosing this for a blocking response asks you to confirm.

Blocking responses start on Ask before running.

Protections that always apply

• Only single addresses are blocked, never ranges.
• Private, internal and reserved addresses are never blocked.
• A never-block list protects your own addresses and partners.
• A cap on blocks per hour, per response and for the whole organization, so a flood of alerts cannot empty your traffic.
• Every block is recorded: who approved it, when it was added and when it ended.