> For the complete documentation index, see [llms.txt](https://canary-1.gitbook.io/canary/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://canary-1.gitbook.io/canary/integrate/onboard-to-cipher.md).

# Onboard to Cipher

How a Cipher engagement starts, and how enforcement is earned from evidence.

Cipher onboarding begins with a working session, not an integration project. Together with Canary, the protocol decides which conditions matter, which systems should be consulted, at what value thresholds, and how each check should behave when it fails.

<figure><img src="https://2589044420-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FpsBN7WLVynXZJOLD5eCk%2Fuploads%2FqhyyQxKDUpp8LSFeL0ZV%2Fobserve-to-enforce.png?alt=media" alt="Three stages of Cipher adoption. Observe: agreed checks run against real traffic and record what they would have decided. Calibrate: thresholds are set from the evidence. Enforce: a proven check is promoted to blocking and begins refusing, with no re-integration."><figcaption><p>Refusal goes live only once observation and calibration show that the evidence supports it.</p></figcaption></figure>

## 1. Define

The working session produces a short policy: the checks to run, the sources each check may consult, the thresholds per chain and pathway, and the failure behaviour of each check. Checks can include reserve accounting, mint-and-burn validation, rate limits, anomaly detection and high-value transfer policies, alongside hooks into the protocol's own systems.

## 2. Observe

From day one, the agreed capabilities run in observe mode against your real traffic. Each check records what it would have decided without gating anything, so you can see exactly what it would have caught and what it would have stopped by mistake.

## 3. Calibrate

Thresholds are set from the evidence rather than guessed. A threshold that would have blocked legitimate traffic is adjusted before it can do so, and a signal that would have caught real anomalies is identified before it is relied on.

## 4. Enforce

When a signal has proven itself, it is promoted to a blocking hook. Promotion requires no re-integration on your side. Everything else stays available to enable whenever it earns its place.

## Why this path matters

You are never choosing between blocking things you do not fully understand yet and having no control at all. Enforcement tightens as the evidence accumulates.

Hooks are permissioned throughout. You control which checks exist, what they may inspect, and whether each one is advisory or blocking, and new checks can be added as your risk stack evolves without changes to your contracts.

## Commercial terms

Protocols that need advanced Cipher capabilities work directly with Canary on tailored commercial agreements. See [Pricing](/canary/pricing.md).