Enforcement & First-Start

operating-mode.observe-only in config.yml defaults to true and operating-mode.enforcement-enabled defaults to false.

Both must be deliberately changed by an administrator before FlagForge can take any preventable action (CANCEL, SETBACK, KICK, or COMMAND) — this is enforced in code (PolicyEngine/ActionDispatcher), not just by default configuration, so no combination of checks.yml/actions.yml tuning can bypass it.

Recommended rollout

Run with both defaults untouched for at least a few days. Detection, alerting, and staff commands all work fully in this mode — only the actual punishment step is inert.
Review /ff history <player> and Discord alerts to confirm thresholds fit your server before touching anything.
When ready, set operating-mode.enforcement-enabled: true in config.yml (or toggle it live with /ff enforcement on <reason>) and set observe-only: false. A response only ever executes if a check's own response-ceiling in checks.yml and a matching rule in actions.yml both permit it — see the Tuning Guide.