I am still bootstrapping from "hands on on every server" to "autonomous system administration".

I edit and test my policy on one server, and then scp the config files to the other boxes.

My Cfengine runs from cron once per hour:

0 * * * * /var/cfengine/bin/cfexecd --no-fork

I can also run it by hand, as for developing or testing policy:

cfagent -v -f cf.filename

Or in extra-careful "make no changes/debug" mode:

cfagent --verbose  --no-edits  --inform  --parse-only -d3 --dry-run