@@ -129,14 +129,10 @@ def _offline_audit(tool_name: str, args: dict[str, Any], run_id: str) -> None:
     import datetime
     _, policy = _config.get()
     if policy == "require_approval":
-        import warnings
-        warnings.warn(
-            f"[Node9] Governance degraded to offline/auto-approve for '{tool_name}' — "
-            "policy is 'require_approval' but no daemon or API key is available. "
-            "Start the node9 daemon or set NODE9_API_KEY to enforce approvals.",
-            RuntimeWarning,
-            stacklevel=4,
-        )
+        # Fail-closed: require_approval means governance must be enforced.
+        # Auto-approving silently would contradict the policy name and create
+        # a false sense of security. Raise so operators see the misconfiguration.
+        raise DaemonNotFoundError(DAEMON_PORT)
     audit_dir = os.path.join(os.path.expanduser("~"), ".node9")
     os.makedirs(audit_dir, exist_ok=True)
     audit_path = os.path.join(audit_dir, "audit.log")
@@ -281,8 +277,9 @@ def evaluate(tool_name: str, args: dict[str, Any], *, run_id: str = "") -> None:
 
     Fail behaviour:
       - Daemon unreachable at call time     → offline mode (fail-open, auto-approve)
-        • If policy == "require_approval" a RuntimeWarning is emitted so the
-          degradation is visible in logs even when nothing blocks.
+        ⚠️  Exception: policy == "require_approval" → DaemonNotFoundError (fail-closed).
+        Auto-approving when approval is explicitly required would be a silent
+        security bypass; operators must fix the connectivity issue instead.
       - Daemon dies mid-request             → DaemonNotFoundError or ActionDeniedException
         (fail-closed: no auto-approve path exists once a request_id is acquired)
       - Daemon timeout / connection closed  → ActionDeniedException (fail-closed)
 
@@ -315,22 +315,20 @@ def test_offline_mode_auto_approves(self, monkeypatch, tmp_path):
             result = evaluate("bash", {"command": "ls"})
         assert result is None
 
-    def test_offline_with_require_approval_policy_warns(self, monkeypatch, tmp_path):
-        """Offline auto-approve must warn loudly when policy is require_approval."""
-        import warnings
+    def test_offline_with_require_approval_policy_raises(self, monkeypatch, tmp_path):
+        """require_approval + no daemon/API key must raise DaemonNotFoundError (fail-closed).
+
+        Auto-approving silently would contradict the policy name — raise so operators
+        see the misconfiguration rather than getting a false sense of security.
+        """
         import node9._config as cfg
         monkeypatch.delenv("NODE9_API_KEY", raising=False)
         monkeypatch.delenv("NODE9_AUTO_START", raising=False)
         monkeypatch.setenv("HOME", str(tmp_path))
         monkeypatch.setattr(cfg, "AGENT_POLICY", "require_approval")
         with patch("node9._client._daemon_reachable", return_value=False):
-            with warnings.catch_warnings(record=True) as caught:
-                warnings.simplefilter("always")
+            with pytest.raises(DaemonNotFoundError):
                 evaluate("deploy", {"target": "prod"})
-        assert any(
-            issubclass(w.category, RuntimeWarning) and "require_approval" in str(w.message)
-            for w in caught
-        ), "Expected RuntimeWarning for offline degradation under require_approval policy"
 
 
 class TestSaaSRoute:
@@ -379,7 +377,6 @@ def capturing_urlopen(req, timeout):
         with patch("urllib.request.urlopen", side_effect=capturing_urlopen):
             with patch("node9._client._daemon_reachable") as mock_check:
                 evaluate("bash", {"command": "ls"})
-                # Assert inside the with block so mock is still active
                 mock_check.assert_not_called()
 
         assert captured_headers, "urlopen was never called"
@@ -395,7 +392,37 @@ def test_saas_denial_raises_action_denied_exception(self, monkeypatch):
         with patch("urllib.request.urlopen", return_value=deny_resp):
             with pytest.raises(ActionDeniedException) as exc:
                 evaluate("bash", {"command": "rm -rf /"})
-        assert "Blocked by policy" in exc.value.reason
+        assert "Blocked by policy" in str(exc.value)
+
+    def test_saas_malformed_response_raises(self, monkeypatch):
+        """SaaS response missing 'approved' key must not silently auto-approve."""
+        monkeypatch.setenv("NODE9_API_KEY", "test-key")
+        monkeypatch.setenv("NODE9_API_URL", "https://api.node9.ai/api/v1/intercept")
+
+        # Missing both 'approved' and 'pending' — should raise, not auto-approve
+        malformed = _make_response({"status": "unknown"})
+        with patch("urllib.request.urlopen", return_value=malformed):
+            with pytest.raises((ActionDeniedException, RuntimeError)):
+                evaluate("bash", {"command": "ls"})
+
+    def test_saas_run_id_defaults_to_empty_string(self, monkeypatch):
+        """run_id omitted from call → empty string sent in SaaS payload (not None / missing)."""
+        monkeypatch.setenv("NODE9_API_KEY", "test-key")
+        monkeypatch.setenv("NODE9_API_URL", "https://api.node9.ai/api/v1/intercept")
+
+        sent: list[dict] = []
+        approve_resp = _make_response({"approved": True})
+
+        def capturing_urlopen(req, timeout):
+            if hasattr(req, "data") and req.data:
+                sent.append(json.loads(req.data))
+            return approve_resp
+
+        with patch("urllib.request.urlopen", side_effect=capturing_urlopen):
+            evaluate("bash", {"command": "ls"})  # no run_id argument
+
+        assert sent, "No request sent"
+        assert sent[0].get("runId") == "", f"Expected empty string runId, got: {sent[0].get('runId')!r}"
 
     def test_saas_run_id_forwarded(self, monkeypatch):
         """run_id is included in the SaaS request payload."""