> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enforce at edge

> Execute policies before data leaves your network

<Badge color="green" icon="bolt">Next sync</Badge> <Badge color="green" icon="rotate-left">Reversible</Badge>

Drop, sample, or transform telemetry before it leaves your infrastructure, without changing application code or provider configuration.

<Note>
  This is the most common enforcement method. Most [policy categories](/policies/categories) recommend it.
</Note>

## How it works

[Tero Edge](/edge) runs in your infrastructure as a proxy. It syncs with the Tero control plane on a fixed interval to fetch policies and applies them to matching telemetry as it passes through.

```mermaid theme={null}
flowchart LR
    Apps["Applications and agents"] -->|"telemetry"| Edge["Tero Edge"]
    Control["Tero control plane"] -. "policy sync" .-> Edge
    Edge -->|"kept and transformed telemetry"| Provider["Observability provider"]
    Edge -. "drop, sample, redact" .-> Filtered["Filtered telemetry"]

    style Apps fill:#262626,stroke:#262626,color:#fafafa
    style Edge fill:#00855c,stroke:#006b49,color:#fafafa
    style Control fill:#0e2b22,stroke:#0e2b22,color:#fafafa
    style Provider fill:#262626,stroke:#262626,color:#fafafa
    style Filtered fill:#d1fae5,stroke:#10b981,color:#065f46
```

## Setup

Deploy the proxy alongside your existing telemetry pipeline:

<CardGroup cols={2}>
  <Card title="Datadog" icon="dog" href="/edge/distributions/datadog">
    Deploy alongside the Datadog Agent on Kubernetes.
  </Card>

  <Card title="OpenTelemetry Collector" icon="circle-nodes" href="/edge/distributions/otlp">
    Deploy alongside the OTel Collector.
  </Card>
</CardGroup>

## Example

Tero identifies that `checkout-api` is emitting 2.3 million health check logs per day. Kubernetes probes hit `/health` every 10 seconds on every pod. Query history shows no recent searches for those logs, and they don't appear in any dashboard or alert.

You approve the policy and select "Enforce at edge." The policy:

```yaml theme={null}
id: drop-health-checks-checkout-api
name: Drop health check logs from checkout-api
log:
  match:
    - resource_attribute: service.name
      exact: checkout-api
    - log_attribute: http.target
      regex: "^/(health|ready|live)"
    - log_attribute: http.status_code
      exact: "200"
  keep: none
```

On the next policy sync, Edge begins dropping logs that match: requests to `checkout-api` on health check paths with status code `200`. Failed health checks (non-200) still flow through since those have debugging value.

In your data quality dashboard, the `checkout-api` health check volume drops after Edge reports filtered telemetry. If something goes wrong, disable the policy and Edge removes it on the next sync. Logs flow normally again.

## When to use

Enforce at edge works best when:

* You want impact on the next Edge sync without code changes
* The waste is infrastructure noise (health checks, bot traffic, tool metadata)
* You need to reduce costs while planning a permanent fix
* You want a temporary block you can revert on a later sync