| Inbox | | | |
| Approvals | Tool calls a workload’s policy held for you to decide, one card per request. “When a run’s policy holds a tool call for a person to decide, it shows up here.” | People named as approvers on a workload | Decide an approval |
| Monitor | | | |
| Overview | The fleet for the chosen window: a findings verdict, coverage, findings over time, top risks, policy decisions in the last 24h and the riskiest agents. | Security leadership; everyone’s first page | Read the Overview |
| Sentinel | Plain-English questions answered from your workspace’s own rows, with every query and cited row shown. Drafts rules for you to review. | Security engineers | Ask Sentinel |
| Agents | ”AI agents detected on N of M enrolled hosts”: agent kinds, installs per host, sessions and unclassified processes. | Security engineers | Sessions, Live Activity and Agents |
| Workloads | Agents running in containers: each workload’s runs, blocks, approvers and keys. | Platform engineers who run agents in CI or on servers | Workloads: agents in containers |
| Live Activity | Scored actions as they arrive: throughput, decision mix, top agents and tools, and the action stream. | Security engineers | Sessions, Live Activity and Agents |
| Sessions | Root sessions in the range, newest first, with events, findings and risk per session. Terminate agent is on the session detail. | Security engineers | Sessions, Live Activity and Agents |
| Detect | | | |
| Divergence | Findings, “Declared intent vs. actual OS action”, filtered by severity, family, verdict and detector. Export CSV. | Security engineers | Investigate a finding |
| Incidents | Grouped detections tracked from Open to Closed, with owner, severity, occurrences and age. “Critical detections are raised here automatically.” | Security engineers; leadership for time-to-resolve | Investigate a finding |
| Shadow Enforcement | What each rule would have done against recent real traffic: Would refuse, Would ask again, Would soft-block, Would allow. | Policy Writers and Admins before arming a ruleset | Shadow enforcement |
| Intelligence | | | |
| Identity Graph | Humans, agents, tools and data as a graph or a table, in three lenses: Trust, Lineage, All. | Security engineers | Data Sources, Inventory, Tool Surface and Identity Graph |
| Inventory | The runtime platforms agents execute on, and the MCP servers machines declare, reconciled against what was observed running. | Security engineers; IT administrators | Data Sources, Inventory, Tool Surface and Identity Graph |
| Tool Surface | The MCP servers and tools agents called, built from observed tool calls only. | Security engineers | Data Sources, Inventory, Tool Surface and Identity Graph |
| Data Sources | Enrolled hosts, the four capture layers per host, events today and last seen, plus the sensor downloads. | IT administrators | Data Sources, Inventory, Tool Surface and Identity Graph |
| Govern | | | |
| Policies | The rules your machines hold, what those rules matched, and who gets notified: a hub with the Rules, Caught actions, Versions, Enforcement and Alerts & incidents sections. | Policy Writers; Admins for Enforcement and for summaries | How policies work, Alerts |
| Compliance | The controls the served policy pack names, and detector fires mapped to framework controls. Not a compliance opinion. | Security leadership; compliance teams | Compliance and Audit Trail |
| Audit Trail | Event search over captured agent activity, Console actions (the administrative log) and audit-chain integrity. | Security engineers; Admins for Console actions | Compliance and Audit Trail |
| Workspace | | | |
| Integrations | Alert channels, event exporters and read-only connectors, with connect, test, rotate and remove. | Admins | Integrations overview |
| Settings | General, Members, Security, API tokens, Notifications, Fleet, Machines & licensing, Data & retention and Audit for the workspace; Appearance for you. | Owners and Admins; every member for Appearance | Members and access, Machines & licensing, Workspace and data |
