Secure · Watchdog
Watchdog
The risk dashboard for agent sessions: findings clustered into ranked signals, with suppression and exclusion actions built in.
The Watchdog page shows the riskiest AI usage in the organization, clustered and ranked. Open it from Secure > Watchdog in the dashboard.
Watchdog replaces the former Risk Overview and Risk Events pages. Old links redirect here.
Access requirements
Section titled “Access requirements”Viewing this page requires the org:admin scope. Access is included in the default Admin role but not the Member role.
Findings and signals
Section titled “Findings and signals”Guardrail policies scan agent sessions and record a finding for every match. Watchdog clusters related findings into signals. A signal groups findings that share a root cause, such as one detection rule firing repeatedly for the same team or app, and ranks the result by severity. Triaging a short list of ranked signals is faster than reading thousands of raw findings.
Headline metrics
Section titled “Headline metrics”Four cards summarize the selected time range against the previous period:
- Org risk score — a weighted score of open risk, driven up by critical signals
- Findings — detection rule matches in the range
- Open signals — active signal clusters, with a count of how many are critical
- Users exposed — users whose sessions produced findings
Exposure bar
Section titled “Exposure bar”The exposure bar breaks findings down by data type, such as secrets or PII. Each slice doubles as a filter: select a data type to narrow the signal list, and select it again to clear.
Active signals
Section titled “Active signals”The Active signals list holds every open signal in the range. Group it by Severity, Data type, Team, or App, and filter by severity or data type.
Selecting a signal opens a drawer with the findings behind it, the detection rule that produced them, and the users and apps involved. From a finding, the full session transcript opens in the same risk-focused view as Agent Sessions, with flagged messages highlighted.
Matched content is redacted by default. Revealing a value is recorded in the audit log.
Acting on signals
Section titled “Acting on signals”Select one or more signals to act in bulk:
- Suppress removes the selected findings from the active list without touching any policy. Suppressed findings stay reviewable.
- Create exclusion rule turns the selection into an exclusion rule, so the same false positive stops producing findings. The criteria prefill from the selection: the exact matched value, the rule, or the detection source.
Findings from prompt-based policies carry a judged verdict rather than a reproducible match, so they can be suppressed but not excluded. Tune those through the guardrail and its detection scope instead.
Suppressed findings
Section titled “Suppressed findings”The Suppressed section below the active list holds everything the signal clusters no longer count: manually suppressed findings and findings matched by exclusion rules. Open one to review why it was suppressed, or restore it to the active list.