Security
Audit events, security policies, posture, and usage quotas for every agent and workflow on the platform.
Every agent and workflow on the platform emits a stream of security-relevant audit events — tool executions, network egress decisions, LLM calls, guardrail checks, and quota denials. The Security area of the console is where you read that stream, define the policies that produce the denials, watch enforcement trends, and manage token spend budgets.
The model is layered:
- Events are the raw, per-invocation record of what agents did and what the platform allowed, blocked, or masked.
- Policies (org-level and workspace-level) define what is denied, what is allowed, which guardrails are required, and the numeric ceilings agents run under. Publishing a policy propagates it to running agents.
- Posture rolls the event stream up into enforcement trends: block rates, the rules doing the work, quota hits, and policy rules that never fire.
- Usage and quotas track token spend and executions, and let org admins set windowed token budgets that gate agent invocations before they start.
The Security area also hosts the Tool Registry — the org-scoped catalog of admitted tools that skills are allowed to reference; unregistered tool references are rejected when a skill is saved and when an agent builds.
Section map
Security events
The audit event stream: where events come from, event naming, and the Events screen.
Policies
Org and workspace security policies, the effective policy, versions, and propagation.
Posture
Enforcement trends: block rate, top rules, quota hits, and dead-rule analysis.
Usage and quotas
Token and execution metrics, and windowed token quotas that gate invocations.