Policy outcomes
Monitor, Warn, Block, Policy Profiles, Controls, Detectors, Signals, and surface capability labels.
AgentKeeper policy should answer three questions in order:
- What happens.
- Where it applies.
- Why it happened.
Outcomes
| Outcome | What happens | Agent or user visibility |
|---|---|---|
| Monitor | The action proceeds and AgentKeeper logs the event silently. | No warning is shown. |
| Warn | The action proceeds and AgentKeeper logs a warning. | Advisory context is shown where the surface supports it. |
| Block | The action is prevented before it reaches the tool or server. | Remediation is returned where the surface supports it. |
Allow or Pass means nothing matched policy, or the event was logged as clean activity. It is not a policy response admins configure.
Policy language
| Term | Meaning |
|---|---|
| Policy Profile | Assignable configuration for Base Policy, groups, or repositories. |
| Control | Deterministic restriction, such as a blocked tool, command, path, domain, or MCP server. |
| Detector | Risk category AgentKeeper can recognize, such as credential exposure or prompt injection. |
| Signal | The concrete check or evidence source that explains why a detector matched. |
Policy Packs still exist as the internal packaging layer behind Policy Profiles. In the product, start with Policy Profiles unless you are debugging pack resolution.
What is a signal?
A signal is optional detail inside a detector. It explains the exact check that matched without exposing regexes or implementation internals by default.
Compact signal detail should include:
| Field | Example |
|---|---|
| What it checks | Looks for cloud credential formats in prompts, files, and tool output. |
| Example evidence | AKIA...REDACTED |
| Where it runs | Claude Code, Codex, MCP Gateway |
| Possible outcomes | Monitor, Warn, Block, or Audit only |
Admins usually configure the detector response. Signals are for explainability when a detector matched or when a custom detector is being tested.
Surface capability labels
| Label | Meaning |
|---|---|
| Can block | This surface can prevent supported actions before they run. |
| Warn advisory | This surface can show advisory context while allowing the action. |
| Audit only | This surface can log evidence but cannot interrupt the action. |
| Partial | This surface supports only part of the configured behavior. |
| Unavailable | This surface does not support this control today. |
When capability is partial or audit-only, the UI should say that before an admin configures the policy. Do not assume Warn or Block works the same way across Claude Code, Codex, Cursor, Windsurf, Copilot, Gemini CLI, Browser Extension, and MCP Gateway.
Verification
After changing a policy, verify it from the surface that will run it:
- Use the setup or health check for that integration.
- Trigger a safe Monitor or Warn test where available.
- Trigger a documented Block test only after the admin expects blocking.
- Confirm Activity or Investigations show the outcome, surface, detector or control, and optional signal detail.