Administration | AI Agent Security

A setting changed in the wrong place can quietly empty an inventory, stop traffic inspection, or leave enforcement off on every endpoint. The Administration page is where you set the defaults every endpoint follows, get the certificate endpoints must trust, and see who changed which setting and when.

Scope of this guide

This guide explains the Administration page: users, the fleet default settings, the Windows driver process exclusions, your tenant trust anchor, the audit trail, and the appearance options. It does not cover setting a value on a single endpoint or tag.

Prerequisites

• You have administrator access to the tenant.

Open the Administration page

Go to Settings > Administration.

Tabs

Users

The Users tab lists everyone with access to the tenant, with their Email, Name, Role, and Status.

Add a user

1. Select Add User.
2. Enter the person's address in the Email field. This is the only required field.
3. Enter their First Name and Last Name.
4. Select Create User.

The confirmation shows a temporary password. It is shown only once, so copy it and share it with the user securely. To close the dialog without adding anyone, select Cancel or the X.

About roles

The Role field is set to Admin and cannot be changed. Additional roles are coming in a future release.

Every user you add is an administrator, with full access to the tenant. There is no way to give someone read-only access, or to let them review sessions without also letting them change policies, revoke endpoints, and add further users.

Two things follow from this:

• Add users deliberately. Each one can change anything in the tenant.
• Separation of duties rests on your own practice. Where your process depends on one person requesting an exception and another approving it, the product does not enforce that split.

Reset a password or remove a user

Each row has two actions at its right end:

Fleet defaults

The Fleet defaults tab sets the values every endpoint uses. As the tab puts it: "Values set here apply to every endpoint unless one of its tags, or the endpoint itself, sets the setting." A fleet default is a starting point, not a fleet-wide guarantee.

How a row works

Each setting is a row with a pin toggle at its left, the setting name and description in the middle, and the control at its right.

• Not pinned means endpoints use the built-in default. The control shows that default but is greyed out and locked, and the row shows a Default badge.
• Pinned means every endpoint gets the value you set here, unless one of its tags or the endpoint sets its own. The row shows a Directly modified badge, with who pinned it and when.

Select the information icon beside a setting name to see which value applies and where it comes from. Select the Directly modified badge to open the Audit trail tab filtered to that setting.

Change a setting

1. Select the pin toggle on the row, so it reads as pinned.
2. Set the toggle, or enter the value you want.
3. Select Apply on that row.

Each setting applies on its own. Changing several means selecting Apply on each one.

To return a setting to its built-in default, select the pin toggle again to unpin it.

Enforcement

The two allow-recording settings overlap. Baseline allow visibility records the specific-policy allows as well, so turning off Specific policy allow events on its own changes nothing. Both must be off to stop recording allows.

Baseline allow visibility is high volume. It records every action that no policy matched, which in an allow-by-default environment is most of what happens. Leave it on when you need complete visibility, and expect the event counts on the Events page to reflect it.

Health reporting

Visibility

The discovery settings are what populate the Visibility pages. Turning MCP discovery or Skill discovery off empties the corresponding inventory over time, so an inventory that looks clean may only mean discovery is off.

Other

Enforcement planes

Telemetry

Break-glass

The break-glass settings exist for an emergency, such as a policy blocking work across the fleet. Pinning either one at the fleet level changes enforcement on every endpoint that does not set its own value, so record why in your change process and unpin it once the emergency is over.

Windows traffic redirect rollout

When the tenant has Windows endpoints, a Windows traffic redirect rollout panel below the settings tracks the redirect, such as 2 of 29 Windows endpoints have the redirect armed.

Roll this setting out to a few endpoints first using per-endpoint values, watch the Armed count climb, then turn it on fleet-wide.

Do not arm browsers (Chrome, Edge, and Firefox). Their traffic is routed, but the inspection certificate is not trusted, so their connections break. AI coding agents such as Node, Python, curl, and git are safe.

To roll back, turn the redirect off. Endpoints disarm at their next sync or restart.

Windows driver process exclusions

The Windows driver process exclusions panel at the bottom of the tab carves specific processes out of specific driver features on every Windows endpoint that uses this list. Only administrators can change it.

An excluded process is invisible to the features you choose for it, on every Windows endpoint in the tenant that uses the list. Exclude a process only when a driver feature is causing a real problem with it, such as a backup tool that fails when its file opens are intercepted.

To add an exclusion:

1. Select Add exclusion.
2. Enter the Process image pattern.
3. Under Features to exclude, select at least one feature.
4. Enter a Note that says why the process is excluded.
5. Select Add exclusion to close the dialog.
6. Select Save.

The list is not saved until you select Save. Select Discard to drop your unsaved changes. When some endpoints use their own exclusion list, the panel says how many, and a save here does not reach them.

Trust anchor

The Trust anchor tab holds your tenant root CA, the root certificate every AI Agent Security agent installs into an endpoint's trust store. It is what makes the agent's TLS interception trusted without a prompt on each device.

You create the anchor once and it secures every agent you deploy. The deploy wizard reuses this same anchor, so you do not generate a new one per deployment.

Get the certificate

Expand Certificate details to see the certificate's Subject, Expires, Tenant, and SHA-256 fingerprint.

Use the format your distribution method expects: the configuration profile for a macOS device management tool, the .cer file for Intune or Group Policy on Windows, and PEM where you need to paste the certificate into a configuration file.

Audit trail

The Audit trail tab records who changed fleet, tag, and endpoint settings, and when, newest first. It records settings changes only.

Filter the audit trail

Enter a value in any of the boxes above the list. The filters combine.

Column reference

Appearance

The Appearance tab controls how the interface looks for you.

Module visibility

The Module visibility table controls which modules appear in your sidebar.

Set a module's Visible toggle to show or hide it. Select Reset to defaults to restore the original selection. Settings is always visible.

These settings affect only you. Hiding a module does not restrict anyone's access to it. Use this to reduce clutter, not to control what people can reach.

Verify the results

After adding a user, confirm they appear on the Users tab with the email address you entered.

After changing a fleet default, confirm the row shows the value you set and a Directly modified badge, then check the Audit trail tab for the change. For Windows traffic redirect, check the rollout figures. Endpoints move from Pending restart to Armed only as their agents restart, so the change is not immediate.

Next steps

• Review the Users list periodically and remove anyone who no longer needs access.
• Download your tenant certificate from Trust anchor in the format your device management tool expects.
• Roll out Windows traffic redirect to a few endpoints before enabling it fleet-wide.