Governance Runs
Runs
Governance › Runs answers two questions. What did my policies decide? What did the engines do to help them?
It has three views, chosen with the View control at the top:
| View | What it lists |
|---|---|
| Decisions | One row per policy decision, blocks included. This is the default. |
| By policy | A card per policy with its decision counts, and the decisions behind it. |
| By engine | A card per engine with its run counts, and the runs behind it. |
A decision is an alert only when a policy's Raise an alert or Notify action, or a justified override, raised one. A plain block is a decision and nothing more. See Alerts and issues.
Who can do it
Runs is read-only. What you see depends on what you hold.
| You hold | You can |
|---|---|
policies:read (View policies) | See Decisions in full, and By policy. |
alerts:read (View alerts) | See Decisions, but with fewer columns. The row keeps its outcome, source, service, machine and inspection; policy, action, engine and connection are not shown, and you cannot filter on them. |
engine_runs:read (View engine runs) | See By engine and the decision trace. Engine runs carry redacted customer text, so this is a separate permission. |
engines:read (View engines) | Open How runs are kept. |
engines:configure (Configure engines) | Change it. |
If you hold neither policies:read nor alerts:read, the page says: "Reading
decisions needs policies:read or alerts:read in this workspace."
Read the decisions
- Open Governance › Runs.
- Choose a window: 1h, 24h, 7d or 30d.
- Use the figures above the list to narrow it. Each is a toggle: Decisions, Blocked, Redacted, Justified and No verdict. A p95 time figure appears when engine runs were timed in the window.
- Use the filter builder, or the search box (Reference, user, machine), to narrow further.
- Select a row to open it.
Filters
| Filter | Values |
|---|---|
| Outcome | Blocked, Alerted, Justified, No verdict, Passed, and for connector actions Done, Failed, Refused |
| Policy | A policy in this workspace |
| Action | Block, Redact, Ask, Connector action |
| Source | Inline rule, Policy, Engine, Connector |
| Service | An AI service |
| Inspection | Not inspected |
| Engine | An engine |
| Machine | A machine |
| Connection | A connection |
With only alerts:read, Outcome leaves out No verdict and Passed.
View chooses which facts each row's second line carries: User, Tool, Machine, Engines and Reason. Include removed adds decisions whose machine or connection has since been removed.
Open a decision
The inspector shows:
- Decision trace, the engine runs the decision waited on, as a waterfall.
It needs
engine_runs:read. - What the policy did, one line per action: what was stopped, redacted,
asked or tagged, whether an alert was raised, and whether an issue joined.
It needs
policies:read.
Some lines you may see: "Request stopped.", "Matched text replaced before the request left.", "Would have stopped it: the policy is in Monitor.", "Not applied: the policy could not tell." and "Not raised: this policy has no Alert action."
An Ask line says what happened to the question, for example "Asked; they confirmed.", "Asked; they declined, so it was stopped." or "Asked; nobody answered, so it was stopped."
A decision whose content was too large to read shows Not inspected: too large. It went through as written. Open it for the size and the limit.
How runs are kept
The button at the top right summarises the current setting, for example "Kept" followed by the window in days and what is kept. It opens How runs are kept:
| Setting | What it does |
|---|---|
| Keep runs and stored artifact bodies for | One window, in days, for every engine run, the artifact bodies the server keeps so a file can be re-scanned, and each machine's address history. A shorter window deletes older rows on the next sweep, and they cannot be brought back. |
| Runs that matched nothing | A slider for how many of those runs are kept. Every run that matched, or had no verdict, is always kept. |
Changing these needs engines:configure.
When it goes wrong
| You see | Why |
|---|---|
| Could not read this workspace's decisions. | The decisions request failed. |
| Could not read the policy cards. | The By policy summary failed. |
| Could not read this workspace's engine runs. | The By engine request failed. |
| Could not load more decisions. | A later page failed. |
| The Machine filter has no options: the fleet could not be loaded. | The machine list failed; rows still name their machine. |
| No decision in this workspace carries that reference. | A reference you searched for does not exist. |
| Your filters leave it out of this list; it is open beside it. | The decision exists, but your filters hide it. |
| Could not load this decision. | The inspector could not open it. |
| Could not save how runs are kept | The save was refused. |
| This workspace's run settings could not be read. | The settings request failed. |
| These settings changed since this dialog opened. It now shows the current values; save again to replace them. | Someone else saved first. |
An empty list says "Policies that are on are evaluated as interactions arrive." when no policy has decided anything yet, with Open policies, or "Nothing was decided in the last 24 hours." (using your window) when policies exist.
With the API
Decisions are in the Policies reference under /decisions.
Engine runs are not available with an API key.