The log window froze.
Security had just kicked in.
Lnav policy enforcement had done its job.
Policy enforcement in Lnav is more than setting rules. It is the active gatekeeper for how you read, search, and filter logs. Misconfigured, it slows teams down. Done right, it locks out risk and speeds up incident response. At its core, Lnav policy enforcement ensures that only the right people see the right information, and that actions in the log viewer follow defined security and compliance standards.
Lnav works locally with the speed of a console tool but has the teeth to follow enforcement rules. These policies can restrict which logs load, what queries run, or which files a user can open. They can track access, block unsafe commands, and guarantee consistent practices across engineers and teams. Strong enforcement decreases error rates and blocks access mistakes that can turn into outages or breaches.
A good Lnav policy enforcement setup focuses on three things: precision, minimal friction, and traceability. Precision means every rule is explicit: no wildcards that expose more than needed. Minimal friction means the policies fit naturally into the workflow—enforcing without nagging. Traceability means every access and action leaves a clear audit trail so you can answer, without doubt, who did what and when.