Your first governed workflow

Before you start

Create a Kastra account, select a workspace, and create a test environment in the console. Confirm that your plan has the features needed for the workflow; the Pro trial does not include every Team or Enterprise entitlement.

You need permission to connect the integration, an administrator to create and activate the test policy, and an authorized approver for HOLD. Prepare a disposable repository or harmless test tool, and keep the operation and expected result written down. For a formal evaluation, use the pilot plan.

Connect one integration

Follow Edge installation, proxy setup, or local MCP setup. Point the integration at the intended environment. Keep normal work in shadow mode while you establish what the policy matches.

Verify an allow

Run a harmless action such as inspecting repository status in a disposable test repository. Open Activity in the console and find the corresponding action. Check its environment, source, tool name, policy revision, and outcome. Correlate by request or tool-use ID where available.

Verify a block without destructive commands

Add a narrow test rule for a harmless, identifiable action or a disposable test file. Activate it only in the test environment. Repeat that action and confirm both the denial response and the absence of its intended side effect. Keep the rule for the HOLD test below, then remove it during cleanup.

Use the actual tool and target attributes from the observed event. Policy authoring explains the editor workflow; policy as code provides a reviewable example. Confirm that the test environment is enforcing for this step: a shadow result alone will not block the operation.

Verify an approval

Change the test rule to HOLD, review its expiry and timeout outcome, and repeat the action. It must wait before the side effect. Approve once and check that it proceeds; repeat with a new action and deny it. Inspect the approval history and final decision. Approval guide.

Record the result and clean up

Check	Completion evidence
Connected scope	Client/version, workspace, environment, and actual tool attributes recorded
Allow	Harmless action completed and its decision was found
Deny	Targeted action stopped and its side effect was absent
HOLD	Pending action waited; approved and denied cases produced their expected outcomes
Cleanup	Temporary rule removed or prior policy revision restored; normal test behavior rechecked

If a check fails, stop expanding the setup and inspect Edge diagnostics or the relevant integration guide. Collect sanitized request IDs and responses for support.

Expand deliberately

Review false positives, fail-open events, and missing coverage before enabling a policy for shared work. An action completing does not prove that no rule matched: an approved HOLD, shadow mode, or cached decision may also allow it to proceed.