# The four policy actions

Every rule in Sentilai resolves to one of four actions. They mean the same thing wherever
they appear.

## Allow

Nothing beyond the ordinary audit row. Use it to carve an exception out of a stricter
default — for example, a default of Block with explicit Allow rules for the MCP servers you
have approved.

## Report

Recorded as a finding. Visible in **Activity** and counted in **Compliance**. Nothing is
interrupted and the developer sees nothing.

**This is the setting you want while you are learning.** It gives you the same visibility
as blocking without changing anyone's day. Most organizations should spend their first
weeks almost entirely in Report.

## Warn

Recorded more prominently and, where the path allows it, surfaced to the developer. Useful
when you want the person to know without stopping them — a nudge, not a wall.

## Block

The request or tool call does not proceed. In Activity the row is tinted with a red rail
and its outcome is **Blocked**.

## How they combine

- **MCP rules**: the most specific rule wins — tool, then server, then pending, then
  default.
- **Across servers in one request**: the most restrictive wins. The Gateway cannot
  partially block a single API call.
- **Detectors**: independent of MCP rules; the strongest action any detector takes
  determines the outcome.