> ## Documentation Index
> Fetch the complete documentation index at: https://docs.esperr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Mitigation

> Mitigations are the responses your policies can trigger — monitor, challenge, or block — reusable across policies and versionable over time.

Current modes:

* `Monitor`: Observe matching traffic without taking an active step.
* `Challenge`: Ask the client to complete an additional verification step.
* `Block`: Stop the matching request from continuing.

If you are implementing a managed challenge flow, use the provider-specific
sub-pages in this section for customer-facing setup guidance:

* [Turnstile](/mitigation/turnstile)
* [Anubis](/mitigation/anubis)

Monitoring is treated as passive mitigation, not as a separate first-class
control-plane object.

## Control-plane definition vs runtime decision

Esper separates:

* the **mitigation definition** you create in the control plane
* the **mitigation decision** emitted after live policy evaluation

The mitigation definition is the reusable policy object. The mitigation decision
is the runtime output for a specific analyzed request or tracked entity.

Mitigation is applied after analysis, not before it. A request can establish or
update mitigation state for an actor, and later requests for that same actor
can then receive the active mitigation response.

## Edge enforcement

`esper capture run --enforce` can sync and enforce active mitigations locally.

Supported behavior today:

* `Block`: request is dropped locally when the captured payload identifies the
  mitigated entity
* `Challenge`: surfaced as a matched mitigation, but not converted into a
  packet-level redirect or CAPTCHA flow
* `Monitor`: surfaced as a matched mitigation without blocking

## Current limitation

Packet capture does not yet derive Esper entities from arbitrary traffic. Local
enforcement therefore currently requires an Esper-managed opaque
`X-Esper-Hybrid-Key` header.

## What you configure for a mitigation

When creating a mitigation, you choose:

* `name`: The label operators see in the console.
* `description`: Optional guidance on when to use this mitigation.
* `mode`: The response type Esper should apply, such as monitor, challenge, or
  block.