Guards live in code.Policy lives in Policy Studio.
Engineering decides which handlers can be protected. Policy Studio decides what happens on them, and changes apply without redeploying the app.
I — OWNED BY ENGINEERING
Guards in code
Handlers opt in with the managed guard. The CLI registers them after a build, without executing your code.
Next.js and Express managed guards
Registered with mandate routes sync
Remove a guard to exclude a route
Machine APIs stay outside browser coverage
app/api/signup/route.ts
import { withMandateManaged }from"@mandate-security/node/next";exportconst POST =withMandateManaged(signupHandler);# after a successful build$ npx --no-install mandate routes sync
II — OWNED BY Policy Studio
Releases in Studio
Pick a registered route, choose a template, and activate a release deliberately.
A new connection starts paused
Drafts never change a live release
Changes apply without a redeploy
Releases are immutable once active
● RELEASEPOST /api/signup · ObserveACTIVE
release 3 · Observeactive
release 2 · Offsuperseded
release 1 · Offsuperseded
02 — HOW A CHANGE SHIPS
Draft. Observe.Review.
Prepare a change, observe it on real traffic, then read decisions alongside business outcomes before deciding anything else.
14:32POST /api/signupproof validNOT LIVE
14:32POST /api/signupproof replayedNOT LIVE
14:32POST /api/signupproof validNOT LIVE
14:31POST /api/signupproof missingNOT LIVE
14:31POST /api/signupproof validNOT LIVE
Prepare and validate a workflow. Editing a draft does not silently change the policy used by an installed integration.
Changes: nothing live until you activate
Activate an Observe release. Decisions are recorded with their evidence; nothing is blocked.
Sees: route, template, grouped decisions
Read verification decisions alongside completed business actions. They answer different questions.
Compares: grouped decisions with completed actions
03 — SPECS
Tech specs
See what is inside the box.
Route inventory
Routes registered from the guards in your code, by method and path. A registered route is not proof that its code is deployed or receiving traffic.
Releases
Immutable releases, activated deliberately. A fresh app connection starts paused with an explicit Off release.
Verify workflows
Native Verify workflows currently observe. More restrictive settings are not a promise of released enforcement.
Limit budgets
Observe, explicit Enforce and Pause in the Node managed candidate.
Evidence
Grouped evaluations, without raw browser fingerprints or private detection details.
Availability
Beta, with the managed SDK preview. Matching preview packages are not yet published to their registries.
Next.js and
Express managed guards