Detections and coverage
Understand what an AgentKeeper detector matches, where it can enforce, and how to interpret active, audit-only, bypassable, and unsupported coverage.
A detector recognizes risky input or behavior. A control defines the policy outcome, and a scenario groups related controls for an operational use case. Seeing a detector in the catalog does not mean every connected surface can block it.
Read a detector result
Each result has three separate parts:
- Match: the detector recognized a pattern or condition.
- Policy: Base Policy, a Policy Profile, or an exception resolved the desired outcome.
- Surface capability: the integration determined whether that outcome could be enforced before the action or only recorded afterward.
Use these labels when evaluating coverage:
| Label | Meaning |
|---|---|
| Pre-execution block | A supported hook or Gateway receives the action before execution and can deny it. |
| Conditional or plugin enforcement | Blocking depends on a compatible version, a loaded plugin, and the event that the product emits. |
| Managed configuration | An admin-enforced setting constrains the integration; it is not an AgentKeeper runtime interception claim. |
| Audit-only | AgentKeeper records the event or post-action result but cannot undo it. |
| Telemetry-only | Provider or collector evidence arrives after the action. |
| Bypassable | A direct, alternate, disabled, or unhooked path can avoid the control. |
| Unsupported | The surface does not expose the required event or integration. |
Verify a blocking claim
- Open Policy outcomes and confirm the selected surface supports a pre-execution decision for the action.
- Run one harmless action and confirm fresh Activity evidence from that exact surface.
- Run a controlled non-destructive action that a known test rule denies.
- Confirm the integration refuses the action before it executes.
- Confirm Activity records the blocked verdict, detector, policy, workstation, and source you expected.
Installation, a self-test, a health response, or an audit event proves a different milestone. None of those alone proves that a live integration can enforce a detector.
The dashboard contains the current detector catalog and organization-specific status. Open Detections after signing in, and use Runtime Shield to configure outcomes.