Loading
Authored runtime-control rules with the signed promote-to-enforce path. Start in record_only, inspect dispatch behavior, then promote with an admin attestation.
Filter to the rules that can act now, or the record_only rules ready for promotion.