Control modes

Policy mode is the master switch for how aggressively ElevateIQ intervenes. Rolling out an EPM tool is a change-management exercise: the modes exist so you can observe before you enforce.

The three modes

Mode	Behavior	Use it when
Enforce	Production posture. Unsigned binaries are blocked by the signature gate; everything else needs a matching allow rule or an approval.	The fleet is inventoried, your baseline rules exist, and surprises are rare.
Audit	Log only. Every elevation attempt is recorded with full identity and context, but nothing is blocked and no approvals are required.	Initial deployment. You want a complete picture of what actually elevates before you gate anything.
Learning	Auto-approve everything and log it. Requests flow through the whole pipeline (scoring included) and succeed without an admin in the loop.	Building your allowlist: a week of Learning tells you exactly which rules to author, with real data.

Set the mode in Settings → Elevation → Policy Mode. It applies per tenant. The recommended path is Audit or Learning first, then Enforce once the request volume settles into rules.

Application allowlisting has its own independent mode (Off, Audit, Enforce) because execution control is a separate, stricter layer. The same observe-first philosophy applies there.

Status colors

Every list in the console uses one consistent set of solid status pills, so a scan of any table reads the same way. Request statuses:

Status	Meaning
Pending	Awaiting a decision.
Awaiting second approval	First approval given; global scope needs one more approver.
Approved	Approved, with the recorded scope and expiry.
Denied	Explicitly rejected; the user should not retry.
Blocked	Stopped by the signature gate or a deny rule; never entered the queue.
Dismissed	Closed without a decision; the user may resubmit with more context.
Expired	Timed out waiting in the queue (tenant-configurable TTL).
Cancelled	Withdrawn by the user, or superseded by a newer duplicate.
Revoked	The rule this approval created was later deactivated by an admin.

Signature status colors

Signature	Meaning
VALID	Authenticode signature verifies against a trusted chain.
UNSIGNED	No signature at all. Blocked in Enforce unless a rule with a hash or thumbprint anchor bypasses the gate.
EXPIRED	Signed, but the certificate has lapsed.
UNKNOWN_CA	Signed by a chain the device does not trust, common with private PKI.
INVALID	The signature does not verify: the binary was modified after signing.
REVOKED	The signing certificate was revoked by its issuer.

The confidence score uses its own five-band palette, documented on its page.