How do I roll Haven out monitor-first?
Short answer
Start in Monitor-only, where Haven records what it would do without changing anything. Watch for about a week, adjust your policy, then switch to Active Enforce. Other browsers pick up the change within minutes.
Why monitor first
Switching a security control on across a team before you've seen what it does is how you block something people needed on a Monday morning. Watching first shows you the effect of a policy before anyone feels it.
New Haven organizations start in Monitor-only: Haven records what it would have done and changes nothing for anyone, while Overview and the Risk Report fill up as they would under enforcement. An owner or admin switches to Active Enforce when ready.
It also eases change management:
While an organization is in Monitor-only, members don't see Haven's badges, link marks or download prompts. What Haven would have done still shows up in the admin console.
Steps
- Get your people in and Haven installed. A single pilot team is a good start.
- Choose what Haven protects: on Protected sites, add the categories and sites your team must have Protected.
- Leave enforcement in Monitor-only for a normal working week.
- Look at what Haven would have done, and adjust your policy.
- Switch Policy, then Enforcement, to Active Enforce.
How settings combine
In a Haven organization, what the organization or a group requires is Protected for every member it reaches, whatever the member would choose: members can't turn it off. A member's Protected sites are everything the organization and each of their groups require, added together. Where organization and group settings disagree on enforcement or a setting, Haven applies the more protective, and someone in several groups gets the most senior role and the most protective policy of any of them.
A Haven group can carry its own enforcement mode, its own Protected categories and sites, an extension allow list and settings, so one organization can hold different teams to different policies. A group's categories and sites reach its members as Required, on top of the organization's.
After you switch
Your own browser applies a change to enforcement straight away. Other members' browsers pick it up within about five minutes, because each one checks for policy changes on a timer.
Reading the reports honestly
In Monitor-only, Haven pauses no extensions, so reports show no extension pauses rather than protection that did not happen.
Trial periods
If your organization is in a monitor-first trial period, switching to Active Enforce is refused until that period ends. Switching back to Monitor-only is always allowed.
How Haven handles this
- New Haven organizations start in Monitor-only: Haven records what it would have done and changes nothing for anyone, while Overview and the Risk Report fill up as they would under enforcement. An owner or admin switches to Active Enforce when ready. The Help Center suggests a normal working week in Monitor-only before switching to Active Enforce.Verified by engineering October 28, 2026
- While an organization is in Monitor-only, members don't see Haven's badges, link marks or download prompts. What Haven would have done still shows up in the admin console.Verified by engineering October 28, 2026
- In a Haven organization, what the organization or a group requires is Protected for every member it reaches, whatever the member would choose: members can't turn it off. A member's Protected sites are everything the organization and each of their groups require, added together. Where organization and group settings disagree on enforcement or a setting, Haven applies the more protective, and someone in several groups gets the most senior role and the most protective policy of any of them. Allowed extensions work the other way: a group's list adds to the organization's allow list for that group.Verified by engineering October 29, 2026
- A Haven group can carry its own enforcement mode, its own Protected categories and sites, an extension allow list and settings, so one organization can hold different teams to different policies. A group's categories and sites reach its members as Required, on top of the organization's. A group's rules can make it stricter than the organization, not looser: a group set to Monitor-only does not relax an organization that is enforcing.Verified by engineering October 29, 2026
- Your own browser applies a change to enforcement straight away. Other members' browsers pick it up within about five minutes, because each one checks for policy changes on a timer.Verified by engineering October 28, 2026
- In Monitor-only, Haven pauses no extensions, so reports show no extension pauses rather than protection that did not happen.Verified by engineering October 29, 2026
- If your organization is in a monitor-first trial period, switching to Active Enforce is refused until that period ends. Switching back to Monitor-only is always allowed. The lock ends on its own when the period ends, and earlier if the trial converts to paid.Verified by engineering October 28, 2026