Tips
HoneyMesh Mode Safety
Use TEST to detect only, ENFORCE for active blocking, and LOCKDOWN only when aggressive enforcement is intended.
The problem
I do not want to over-enforce before the evidence is clear.
Operator approach
Start with the documented workflow for the tool, collect evidence, and keep the next step visible before changing settings, blocking traffic, unlocking storage, or transferring sensitive files.