# Watchdog

The **Watchdog** page shows the riskiest AI usage in the organization, clustered and ranked. Open it from **Secure > Watchdog** in the dashboard.

<Callout type="info">
  Watchdog replaces the former Risk Overview and Risk Events pages. Old links redirect here.
</Callout>

## Access requirements

<Callout type="info">
  Viewing this page requires the `org:admin` scope. Access is included in the default [Admin role](/docs/ai-control-plane/org-admin/roles-and-permissions) but not the Member role.
</Callout>

## Findings and signals

[Guardrail policies](/docs/ai-control-plane/secure/guardrails) scan agent sessions and record a finding for every match. Watchdog clusters related findings into signals. A signal groups findings that share a root cause, such as one detection rule firing repeatedly for the same team or app, and ranks the result by severity. Triaging a short list of ranked signals is faster than reading thousands of raw findings.

## Headline metrics

Four cards summarize the selected time range against the previous period:

- **Org risk score** — a weighted score of open risk, driven up by critical signals
- **Findings** — detection rule matches in the range
- **Open signals** — active signal clusters, with a count of how many are critical
- **Users exposed** — users whose sessions produced findings

## Exposure bar

The exposure bar breaks findings down by data type, such as secrets or PII. Each slice doubles as a filter: select a data type to narrow the signal list, and select it again to clear.

## Active signals

The **Active signals** list holds every open signal in the range. Group it by **Severity**, **Data type**, **Team**, or **App**, and filter by severity or data type.

Selecting a signal opens a drawer with the findings behind it, the detection rule that produced them, and the users and apps involved. From a finding, the full session transcript opens in the same risk-focused view as [Agent Sessions](/docs/ai-control-plane/observe/agent-sessions), with flagged messages highlighted.

Matched content is redacted by default. Revealing a value is recorded in the [audit log](/docs/ai-control-plane/org-admin/audit-logs).

## Acting on signals

Select one or more signals to act in bulk:

- **Suppress** removes the selected findings from the active list without touching any policy. Suppressed findings stay reviewable.
- **Create exclusion rule** turns the selection into an [exclusion rule](/docs/ai-control-plane/secure/exclusions), so the same false positive stops producing findings. The criteria prefill from the selection: the exact matched value, the rule, or the detection source.

Findings from prompt-based policies carry a judged verdict rather than a reproducible match, so they can be suppressed but not excluded. Tune those through the guardrail and its detection scope instead.

## Suppressed findings

The **Suppressed** section below the active list holds everything the signal clusters no longer count: manually suppressed findings and findings matched by exclusion rules. Open one to review why it was suppressed, or restore it to the active list.