[Yandex Cloud documentation](../../../index.md) > [Yandex Security Deck](../../index.md) > [Step-by-step guides](../index.md) > [Kubernetes® Security Posture Management (KSPM)](index.md) > Managing rule modes

# Managing the operating modes of security control rules of KSPM

The `Admission` type security control rules of the KSPM module have two operating modes:

* `Audit`: Mode in which a rule violation does not block the deployment of workloads in Kubernetes clusters. Default mode.
* `Blocking`: Mode in which a rule violation leads to blocking the deployment of workloads in Kubernetes clusters.

## Enabling Blocking mode {#enable-enforce}

To enable `Blocking` mode for a rule:

{% list tabs group=instructions %}

- Security Deck UI {#cloud-sd}

  1. Go to [Yandex Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select ![file-text](../../../_assets/console-icons/file-text.svg) **Rules and exceptions**.
  1. At the top of the window, select the [workspace](*workspace) you want to change the rule mode in.
  1. On the **Security control rules** page that opens, go to the **Kubernetes®** tab. In the list that appears, find the `Admission` type rule whose mode you want to change. Optionally, use the filter at the top of the list.
  1. Click **Mode: Audit** ![chevron-down](../../../_assets/console-icons/chevron-down.svg) next to the rule and select `Enable block mode`.
  1. In the window that opens, confirm enabling lock mode.

  You can also change the rule's operating mode in the **Rule type
** field on the rule's detailed info page.

{% endlist %}

## Enabling Audit mode {#enable-audit}

To enable `Audit` mode for a rule (if `Blocking` mode was previously enabled for this rule):

{% list tabs group=instructions %}

- Security Deck UI {#cloud-sd}

  1. Go to [Yandex Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select ![file-text](../../../_assets/console-icons/file-text.svg) **Rules and exceptions**.
  1. At the top of the window, select the [workspace](*workspace) you want to change the rule mode in.
  1. On the **Security control rules** page that opens, go to the **Kubernetes®** tab. In the list that appears, find the `Admission` type rule whose mode you want to change. Optionally, use the filter at the top of the list.
  1. Click **Mode: Blocking** ![chevron-down](../../../_assets/console-icons/chevron-down.svg) next to the rule and select `Disable block mode`.
  1. In the window that opens, confirm disabling lock mode.

  You can also change the rule's operating mode in the **Rule type
** field on the rule's detailed info page.

{% endlist %}

## Managing lock mode with the help of exceptions {#apply-exception}

When you activate `Blocking` mode for a rule, by default it applies to all Kubernetes® clusters in the [workspace](*workspace).

To change this logic and explicitly specify which Kubernetes® resources in the workspace will not be subject to `Blocking` mode, create an [exception](*exception) to the rule:

{% list tabs group=instructions %}

- Security Deck UI {#cloud-sd}

  1. Go to [Yandex Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select ![file-text](../../../_assets/console-icons/file-text.svg) **Rules and exceptions**.
  1. At the top of the window, select the [workspace](*workspace) in which you want to set up an exception for the security control rule.
  1. On the **Security control rules** page that opens, navigate to the **Kubernetes®** tab and select from the list the `Admission` type rule you want to create an exception for. Optionally, use the filter at the top of the list.
  1. In the rule info window that opens, go to the **Exceptions** tab and click **Create exception**.
  1. Under **Effect**, select the correct lock mode:
  
      * `Ignore rule`: Checks for compliance with the rule for the resources named in the exception are off completely; no violations are logged.
      * `Disable lock mode for rule`: Violations of the rule for the resources named in the exception will be logged, but deployment of workloads in Kubernetes® clusters will not be blocked.
  1. Under **Scope**, specify the clusters for which to cancel the lock, configure other settings, and complete the exception setup.

      {% note tip %}

      If necessary, look up [Managing exceptions from KSPM security control rules](manage-exceptions.md).

      {% endnote %}

{% endlist %}

[*workspace]: Security Deck workspaces allow you to manage Yandex Cloud infrastructure security in a more granular way. They are containers for settings and resources of Security Deck modules, lists of controlled resources, control parameters, etc. For more information, see [Security Deck workspaces](../../concepts/workspace.md).

[*exception]: You can use KSPM exceptions to specify objects you want excluded from the control rules in place. For more information on exceptions, see [Managing exceptions from KSPM security control rules](manage-exceptions.md).