Mandatory hold
What it does
Irreversible and high-value actions are held for a human and mass-destructive ones are blocked outright, whatever any policy says.
Irreversible and high-value actions are held for a human, and mass-destructive ones are blocked outright, independent of what any specific policy says.
When it applies
On irreversible and high-value actions, always, regardless of policy.
How it works
Independently of policy, irreversible and high-value actions are held for a human and unbounded destructive actions are blocked outright. It is a fail-safe backstop that a permissive or misconfigured policy cannot override.
In practice
A mass delete or a large wire is stopped by default even if a policy would have let it through.
What you get
The held or blocked action and the rule that fired are logged.
Why it matters
The single catastrophic action is stopped by default, not by luck.
Even a good policy set can have a gap. Mandatory hold is a fail-safe backstop for the most destructive actions, so a mistake in policy cannot let a catastrophic action through automatically, a floor under the whole policy layer.