Enforcement mode
Terminators attest every input action, both keystrokes and mouse clicks. When an input action is not coming from a workstation with a legit Keystrike client, and thus not attested, an alert is triggered.
When the terminator is in Enforcement mode, every input action of the unwelcome user is blocked.
When enforcement mode is off, also known as Audit mode, the user can perform all input actions just as if Keystrike was not present, but alerts are still triggered for every action.
Enforcement mode is configured via Terminator groups, but can also be overridden on a per terminator basis. The recommended way is to only override temporarily on a per terminator basis and have configuration on the group level.
The main reason for per terminator override would be to temporarily switch a terminator from enforcement to audit mode.