BeyondTrust managed policies | AI Agent Security

Everything is allowed by default, and each policy blocks or records specific actions. An empty policy list is an unrestricted environment, and writing your first policies from a blank page means guessing which agent behaviors matter. The BeyondTrust Managed tab removes the guesswork: a curated set of policies covering the agent behaviors that most often turn into incidents, grouped into categories you can work through one at a time.

Scope of this guide

This guide explains the BeyondTrust Managed tab: the curation line, the two views, how managed policies run on your endpoints, how to adapt one, and the full list of managed policies. It does not cover writing policy rules or managing list contents.

Prerequisites

• You have administrator access to the tenant.

Open the BeyondTrust Managed tab

1. Go to Protection > Policies.
2. Select BeyondTrust Managed.

The number in the tab label is the total number of managed policies. Search applies on top of it, so the list can show fewer policies than the tab label. The difference is your search, not a missing policy.

Curation

The line below the tabs reads Curated by BeyondTrust Phantom Labs. Phantom Labs research keeps this set current as agent behaviors change, which is the practical reason to check here before writing a policy of your own.

Select Registry details to see where the set is served from: Serving, Generation, Digest, Artifacts, and Parity. Select Hide registry details to collapse them again. These details are for troubleshooting with BeyondTrust support; day-to-day use does not need them.

Choose a view

Two buttons at the right of the tab content change how the policies are presented.

• Select List to see every managed policy as a flat list.
• Select Categories to group them into category cards. Each card names a category and the number of policies it holds. Select a card to open that category, then select All categories to return to the cards.

To find a policy by name, enter all or part of it in the Search policies box. The Category filter is not offered on this tab; use Categories view instead.

How managed policies run

A managed policy runs at Audit or Off, never at Require Approval or Block.

Three things follow from this:

• Managed policies record, they do not block. Every managed policy outside Example templates starts at Audit, so it records what it matches without stopping anyone. Review that activity on the policy's Activity tab to see what it would block.
• They reach every endpoint through the default tag. Every endpoint carries the built-in default tag, including endpoints enrolled later, and that tag applies the managed policies to the whole fleet. You can also attach a managed policy to specific endpoints or tags from its Attachments tab.
• To block, fork the policy. Open the policy and select Fork to my policies. The fork is an ordinary Customer Managed policy that you can edit, test, and set to Require Approval or Block.

You can turn a managed policy Off or back to Audit from its details panel. You cannot edit, delete, or run a test against a managed policy; fork it first.

Example templates

The Example templates category holds starter policies for controls that depend on your own values, such as an AWS account number, an Azure tenant, or an internal API host. Each one carries a Template badge, ships turned Off, and has placeholder values such as your-aws-account-id that match nothing in your environment.

To use a template:

1. Open the template and select Fork to my policies.
2. On the Fill in your values screen, replace each placeholder with your own value, then select Continue. Select Skip for now to go to the rules with the placeholders still in place.
3. Test and publish the fork, then attach it where it is needed.

Turned-off templates are not applied through the default tag, so a template affects no endpoint until you fork it and publish your copy.

BeyondTrust managed policies list

The table lists every BeyondTrust Managed policy, with the description it shows in the product. Select a policy's name on the BeyondTrust Managed tab to see its rules and activity.

Verify the results

Confirm that the BeyondTrust Managed tab count matches the number of policies in the list above. Open a managed policy outside Example templates and confirm it reads Audit, then check its Activity tab for recorded matches.

Next steps

• Review the Activity tab of each managed policy that has recorded matches, and decide whether you need it to block.
• Fork any managed policy you want to block, and set the fork to Block or Require Approval.
• Fork the Example templates that fit your environment and fill in your own values.