Pause & Resume · node9 documentation

Pause & Resume

Turn enforcement off for a set time when it is in your way, and get it back without waiting.

Pause turns off everything, not some of it
A paused machine approves every tool call. The credential jail, every shield, the content scanner, the runaway-loop cut-off and the prompt gate are all skipped. The check happens at the top of the decision path, so nothing further down is ever consulted. There is no setting that survives a pause.
Pausedefault 15m
node9 pause              # 15 minutes
node9 pause -d 1h        # an hour
node9 pause -d 30s       # half a minute
The duration is the point. Enforcement comes back on its own, so a pause you forget about is not a machine left open indefinitely.
Resume
node9 resume
Ends the pause immediately, whatever time was left on it. Run it the moment you are done rather than waiting out the clock.

What a pause does not do

It does not stop the recording. Calls made while paused are still written to the audit log and marked as such, so a pause leaves a gap in enforcement and no gap in the record. You can see exactly what ran during one, and so can anyone reviewing the machine later.

Finding what happened during a pause
node9 audit            # local log; paused calls are labelled
node9 report           # the same period, summarised
On a machine connected to a workspace, those calls reach Mission Control the same way every other decision does.
Checking before you assume
node9 status
Says whether the machine is paused right now and until when. Worth running before concluding that something got through a rule, because a pause looks exactly like a rule that failed to fire.