What is a Policy Dry Run?
A policy dry run is a mode where Intercept evaluates policies and logs the decisions that would be made, but does not enforce them — all tool calls are allowed to proceed regardless of the policy result.
WHY IT MATTERS
Deploying untested policies to production is reckless. A policy that accidentally denies a critical tool call can break an agent's workflow entirely. A policy with overly broad conditions might block legitimate operations. Dry run mode lets you deploy policies alongside live traffic, observe what would happen, and refine rules before they have any impact.
Dry run is particularly valuable when migrating from an uncontrolled environment to policy-enforced operations. You start with dry run enabled, observe the logs to understand your agent's actual tool call patterns, write policies based on real behaviour rather than assumptions, and then switch to enforcement once you are confident in the rules.
The dry run output is identical to normal operation — the same decision log entries, the same matched rules, the same evaluation pipeline — except the action is always "allow." This means you can directly compare dry run logs to what enforcement would look like, without any translation layer or mental model shift. When you are ready to enforce, you simply disable dry run.
HOW POLICYLAYER USES THIS
Intercept supports dry-run mode at the global, server, and individual rule level. In dry-run mode, policies are fully evaluated — conditions checked, rules matched, actions determined — but the final enforcement step is skipped. All tool calls proceed to the MCP server. The decision log records what would have happened, tagged with a dry-run flag. This lets you run dry-run and enforced policies side by side: enforce known-good rules while dry-running new ones.