# Monitor without blocking (/docs/recipes/monitor-without-blocking)
Before you let TokenPolice block anything, you usually want to just *watch*: see your spend, your
per-user costs, and how often your rules would fire — with zero risk to your app. That's the
default, and it takes no special setup.
## The snippet [#the-snippet]
Leave the SDK in **dry-run** (the default). It runs the full check on every call and records what
it *would* do, but never blocks or reroutes:
```python
import token_police as tp
tp.init(
api_key=os.environ["TOKENPOLICE_API_KEY"],
base_url="https://collect.tokenpolice.ai",
firewall="dry_run", # the default — watch, don't act
)
```
```typescript
import { init } from "token-police";
init({
apiKey: process.env.TOKENPOLICE_API_KEY!,
baseUrl: "https://collect.tokenpolice.ai",
firewall: "dry_run",
});
```
Attach identity as usual so the dashboard can break spend down per user and plan — see
[Cap free-tier users](/docs/recipes/cap-free-tier) for the `@tp.workflow` pattern.
**`off` is not the same as `dry_run`.** `off` skips the check entirely and only logs usage, so
you get costs but no *"would-block"* projections. Use `dry_run` to preview rules.
## Then add rules — still watching [#then-add-rules--still-watching]
New Block and Reroute rules are created in **Dry-run** too, so even after you flip the SDK to
enforce, each rule keeps only projecting until you switch *it* over. Nothing is stopped unless
both dials say enforce — which is how you roll out one rule at a time. The full truth table is in
[Dry-run vs enforce](/docs/concepts/dry-run-vs-enforce).
Watch the projections on the **Dry-run** tab in your [dashboard](/docs/dashboard); when the
numbers look right, switch the rules you trust to Enforce.
## Next [#next]