Visibility, simulation, enforcement

Why the order matters

Writing deny rules against a network whose actual dependencies are unknown is how segmentation causes outages. Innerwall’s path is visibility first, simulation second, enforcement last (ADR-0001). Visibility is every workload’s starting mode, the evidence is shown at each step, and moving a workload to enforcement is an operator’s act.

The three modes

Each workload has an enforcement mode, which its agent applies in the nftables table it owns (ADR-0020):

• Visibility. The owned table holds no verdict chain, so nothing is evaluated and nothing is dropped. The agent observes the connections that reach the workload and reports them as flows.
• Simulation. The agent installs exactly the ruleset enforcement would install, except the terminal rule, which logs and accepts instead of dropping. Traffic that enforcement would drop is recorded as would-block.
• Enforced. The same ruleset with a terminal rule that logs and drops. Dropped traffic is recorded as blocked.

Simulation and enforcement are one rendering that differs in one line, and a test in the repository asserts exactly that. A simulation result is therefore evidence about the ruleset enforcement would install, not an approximation of it.

Moving between modes

Modes change per workload or by label selection, never as one estate-wide switch (ADR-0001).

• The console’s simulation review shows a ruleset’s would-block traffic from the workloads simulating it, with a verdict on whether it is safe to enforce and any gaps in the evidence.
• The console’s promotion to enforcement asks for an explicit acknowledgment when the verdict is not safe or the evidence has gaps.
• The operator surface and the command line accept a mode change directly, for automation. A server-side guard on mode changes is on the roadmap; in this release the gate lives in the console.

Evidence gaps

When the agent knows it lost evidence (the kernel dropped events, a source restarted, a bound was reached), it records the interval as an evidence gap and ships it with the next flow window (ADR-0019). A verdict drawn from a range with a gap in it is not drawn from complete evidence, so the simulation review shows the gaps beside the traffic.