Use the console

Open Getting started for a guided path. You can return to any step. On a phone, Menu opens navigation to every page you can open, with agent connections, policies, people and monitoring among them.

Getting started opens on the first step this Space has left, and the address keeps the step, so a reload or Back returns to it. A step that is done shows a tick and, inside it, when it was done and a link to the record that did it: the agent's API key, the first request, the active policy and the first decided approval. The ticks come from records, never from a click. The sidebar's Getting started card shows how many required steps are done and which is next; it becomes an ordinary row once every step is done. To hide it in this browser, select Hide setup progress in the sidebar at the foot of Getting started; Show setup progress in the sidebar there or on Help & support brings it back.

If this Space has no registered connection, its agents' requests are refused until it has one and an active policy. Getting started, Home and Policies then say what would give it one: the sample targets, where adding them can reach a decision in this Space; otherwise the commands your deployment's operator runs to register a provider account and its mappings for this Space, which you can copy for them.

Try a safe example

Choose a workstation, protected domain controller or production target and select Run safe example. The result explains allow, deny or approval using fixed synthetic facts and a synthetic policy. Nothing is executed, your workspace policy is unchanged, and the example does not verify a real connection.

Connect your agent

1. Open Agent connections, select Add agent, and give it a recognizable name.
2. In Connect this agent, choose a lifetime, up to 90 days or Never, and Issue API key. Nothing is chosen for you: a Tines story or another long-running integration usually needs 30 or 90 days. The agent sends the key as Authorization: Bearer <API key>. Save it when shown; it is not available again after closing the dialog. API keys in the sidebar lists every agent's keys and issues or revokes them; Authentication in the API reference covers the header and replacing a key.

An agent's page shows one section at a time, chosen from the strip under its name and kept in the address, so a link, a reload and Back return to it: Overview (a summary of its state, last request, live keys and the closest limit, any key expiring soon, its name and this month's requests), Connection (Connect this agent and its API keys), Permissions (what its policy allows, each rule as a sentence with its effect, and its limits), Activity (its recent requests, each linked to its record, and what a monitoring source observed) and Advanced (binding, deactivation and Explain). A new agent opens on Connection; an agent that has made requests opens on Overview, and its Connection folds the steps under one line. Someone who can see an agent without administering its Space is offered no change on its page.

Both key tables, on the agent's page and on API keys, show when each key expires and when it was last used, relative to the server's clock, with the exact time in the element's title. A live key that expires within seven days carries Expires soon. A key's last use is recorded at most once a minute and is shown only; nothing authorises, expires or revokes by it. To replace a key, select Rotate key N on its row: the new key is issued for the same agent with a lifetime you choose, shown once, and recorded as replacing key N, which keeps working until you revoke it so you can update the tool that uses it first. Only Rotate marks a key "live, replaced by a newer key"; issuing another key replaces nothing, because an agent often holds a key for each integration. A key that has been used and expires within seven days, and that no rotation replaces, is announced on its agent's page and, for administrators, on Home under API keys expiring soon (at most five agents, the rest counted and linked to API keys). The notice goes when the key is rotated, revoked or expires. 3. Choose your host and copy its configuration. Replace the placeholder in the client's private secret configuration. Keep upstream provider credentials outside the agent's access. 4. Submit an intended request for a test resource you control, then select Check connection. For positively identified sample fixtures, the page identifies a mock target and incident. This connected test may execute an action; the safe example above never does. 5. Open the agent's activity and inspect the decision, execution outcome and evidence. Listing tools or issuing a key does not prove the action is governed.

After a key is issued, Connect this agent waits for the agent's first request while the tab is open, checking every 10 seconds for up to 10 minutes; Resume starts it again. When the request arrives it shows the request's state and reference with Open this decision. A held request waits for a reviewer in Approvals. If nothing arrives, check the server URL and key in your host: a request refused before authentication leaves no record.

To govern a Tines story, choose Tines story as the host. Download the Execute story (ExecBound dispatches with its own connector) or the Gate story (your vendor credential stays in Tines), and follow the steps shown: the credential that holds this agent's key, the resources that hold this gateway's origin and the approval wait, the team to import into, then either opening the story's Entry action once or enabling Send to Story. Both are Advisory for Tines: nothing forces a story to call ExecBound.

Pilot in Observe only is an optional card in Set your controls. In Observe only each request is recorded with what it would have done, and nothing is dispatched, approved, reserved or claimed. A policy must still be active, the mode applies to the whole workspace, and the sample targets' approval loop needs Enforcing. Changing the mode needs a reason and is recorded; Review what would have happened lists the observed requests.

Enforcing applies to participating requests and their configured mappings. Some mappings can remain observe-only or use an external executor. Calls that bypass the gateway or executor are outside that protection. Open the mode label for this explanation at any time.

Understand a request

Open Activity and select a request. The summary separates what policy decided, what execution evidence establishes, and the next safe step. Decision evidence retains the recorded codes and evidence. An approval authorizes a specific plan; it does not itself prove execution. An unknown provider outcome needs investigation before another attempt.

An older record may not distinguish an explicit deny from a missing permit. The console states that limitation rather than guessing the cause. Under a policy written as rules, a denial names the rule it matched and links to it on the policy's rules page, where the rule is marked, if you may open that policy.

An approval whose deadline passed reads Approval lapsed as soon as the deadline passes, on the server's clock, and Approved, but not used before the deadline when a person approved it and the agent did not use it; nothing ran either way, and the next cleanup run closes the record. Effect unknown on Home counts outcomes whose effect nobody has established; they stay there until someone settles them.

What ExecBound did, under the chart on Home, counts the requests made in the range by what became of them: refused by policy, by a limit or because another request held the target, held for a person and approved, refused, lapsed or still waiting, and uncertain dispatches settled. Every number opens the Activity list it counts. Full report prints the same list and downloads it as a CSV. These are counts of what ExecBound recorded; a refusal is not proof that harm was prevented. Under My account, the Weekly summary sends the same counts by email each Monday, where your deployment offers it; you can stop it from the email itself.

Times, names and words

Times. Every time names its zone, or sits under a heading or column that names it: 2026-10-08 13:34 EDT, with seconds where the second is evidence. Times read in your own time zone unless you choose UTC under My account → Appearance → Show times in; the choice is remembered for this browser alone and nothing records it. Hover a time to read the same instant in the other zone. A row in Activity from an earlier day carries its date before its time. A deadline reads 4 min left, by 13:39 EDT. "Today" on Home, the Live board and Decided today starts at your midnight in the zone you chose.

Names. An agent is its label, else Agent 3; a person is their label, else User 3. The number is this workspace's own counting number for that agent or person and means nothing in another workspace. Where a label is shown, its handle sits beside it, so two agents with the same label stay apart. An agent or a person without a label offers one field under its page heading to name it. In the search palette, type agent 3 or the start of an agent's id to find it; an administrator who manages access can find a person the same way, with user 3, though never by email.

Words. A person's answer to an approval is Approve or Refuse, recorded as Approved or Refused. Credentials, invitations and tokens expire; only approvals lapse.

Term	Meaning
Workspace	One customer's or team's ExecBound: its people, agents, policies and records. The console calls this a workspace; some older pages still say "tenant"
Space	A part of a workspace with its own agents, policy and members. A view and a permission boundary, not isolation
Policy version	One immutable version of a space's policy
Approval rule	Which people may decide which held actions
Impact limit	A cap on how many targets a set of actions may reach in a window, shared across agents
Enforcing, Observe only	The workspace's mode: decisions are applied, or only recorded with what they would have been
Request	What an agent asks ExecBound to do, referenced as EB-12
Held	A request waiting for a person's approval. Its approval is "Waiting for a person", or "Waiting for you" to someone who can decide it
Approve, Refuse	A person's answer to an approval; recorded as Approved or Refused
Denied	The outcome of a request the policy or a person refused; its reason line says which
Lapsed	An approval whose deadline passed before anyone decided it. It cannot be used; the agent must send a new request
Stale	A request whose authority no longer held when it came to run, such as an approval that lapsed or facts that expired
Observed	Decided in observe-only mode; nothing ran
Uncertain outcome (Unsettled, Effect unknown)	Dispatched, with the provider's outcome not yet established. An administrator settles it from evidence; it is never retried without that evidence
Agent 3, User 3	The workspace's own number for an agent or a person without a name. It means nothing in another workspace
Times	Every time names its zone: yours unless you chose UTC under My account. "Today" starts at your midnight in that zone

Set up a reviewer

Where the deployment can send email, the shortest route is an invitation. Under Team & access, open Users and Invite teammate, choose the Approver role and its Space, and choose the Reviewer group an approval rule names. The dialog lists the rules for that group and how many people could decide that work now; a group that grants more than the invitation cannot be chosen. They land on Approvals when they accept with a new password, already in the group. If the invitation expires first, it stays under Invitations as Expired with Invite again.

Otherwise, add them yourself:

1. Under Team & access, open Users and Add user.
2. Enter a name and sign-in email. Creating the account does not send an invitation email automatically.
3. Open the person's account and complete password setup or use the configured directory provider. If issuing a password setup code, share it privately using your organization's normal process.
4. Give them the Approver role with Edit roles, then assign the actions and targets they may review under Review permissions, or add them to a group an approval rule names. Administrators also need the role and an explicit assignment.

An administrator can also assign themselves to one waiting request from the approval page. Under Approvals, Waiting on others lists the requests in your view that you are not assigned to decide, with the time left and who can decide each; open one and choose Assign yourself to review this. It is the same assignment Review permissions makes, recorded in the audit log, and it asks for your second factor if you last verified it more than thirty minutes ago. An assignment is per action and target, so if you already review that action on that target in another Space, the dialog says your review moves to this request's Space and the button reads Move my review to that Space; nothing is written until you confirm. If the request belongs to another Space, switch to it first. On the same panel, Copy approval link gives you the request's own address to send to whoever should decide it.

On Getting started, Set your controls lists under Choose who can review each action this Space's policy can hold that nobody here can review yet, by the action's name. Add a reviewer opens the assignment dialog with that action chosen, and Assign me, offered where you may review it yourself, opens it with you chosen; nothing is assigned until you confirm. A custom policy's actions read "Coverage unknown for this policy", because which requests it holds cannot be read from it. Only someone who administers people and access sees the list.

Reviewers use their normal sign-in account. Historical bearer credentials remain available for inspection and revocation in Advanced controls; the normal setup path does not issue reviewer credentials.

Change a policy

Open Policies in the Space you administer and choose a named start. If that Space has available action mappings but no active policy, the security response baseline can create its first draft. Otherwise, copy current protections or add review requirements to them. Accounts and shared policies must be available to that Space.

A policy goes live in three steps, in order, under Make this policy live: Validate, Preview, then Activate. The preview replays recorded history only when you ask for it, over the last 7 days unless you choose another window; a Policy manager's preview counts only the decisions recorded in the Spaces they manage. Changes from the active policy shows how a draft's rules, budgets and mappings differ from the policy in use, as the rules read. Activation opens on what the preview found, or says none was run, names the policy it replaces, and asks What changed and why; the reason is kept in the audit record and shown on the policy list. The safe example does not preview your policy; the policy page does. A preview with no relevant history cannot establish coverage for untested actions.

The list shows current versions first; retired versions are folded behind Show N retired versions. To carry rules to another workspace, choose Download rules on a policy written as rules, then Start from a rules file in the other workspace's Space. The file leaves out budgets counted for a named group, account or Space, and context settings, and the new draft still has to be validated, previewed and activated.

Custom Cedar and advanced budget structures may require the complete configuration editor. The console refuses conversions that would discard protections. A deployment without supported mappings needs its operator to configure the connector path before a useful policy can be created.

Connect a monitoring source

Open Monitoring → Connect a source, choose Tines or Entra, and follow the permissions and collector commands. An operator runs the collector on the trusted host and stores its provider credentials privately. Collection and scheduling are not performed by the browser.

Where your deployment connects Tines from the console, Connect Tines asks for a connection name, your Tines tenant's address, an optional team and a read-only API key. The key is sealed for ExecBound's collector when you connect: this web service cannot read it back, and it is never shown again. The connection belongs to the Space you are looking at; with several Spaces, choose one first. In a Space you review but do not administer, the form says on its first step that it cannot add a connection there and goes no further, so it never asks for the key, and Connect Microsoft Entra says so as it opens, before you continue to Microsoft; an archived Space, or no Space chosen, stops the form the same way; a connection's own card still offers its actions there, and says the Space is not yours to change when the server refuses one. Verification then opens for the new connection, and the first collection runs within five minutes. Connecting asks you to verify your identity if you have not recently.

Where your deployment connects Microsoft Entra from the console, Connect Microsoft Entra says what its app reads (read-only directory permissions, nothing that can write), who can approve and how to withdraw, asks for a connection name and continues to Microsoft. A Global Administrator or Privileged Role Administrator of the directory signs in and approves read-only access; nothing is created until they do. When Microsoft sends you back, Monitoring says what ExecBound recorded: the connection made, with its verification open, or that nothing was created, and what to remove in Microsoft if access was already approved. A directory can be connected to one workspace only. Starting asks you to verify your identity if you have not recently.

Each connection's card says how it authenticates (a key sealed for the collector, an operator's key file, or a directory's admin consent, with when and by whom the consent was last recorded) and when it is next due. Collect now asks the next scheduled run to collect it; the card says who asked and when once the server has recorded it. Schedule sets how often it is collected: a Tines connection's audit records every 5, 15, 30 or 60 minutes, with its inventory daily, or a Microsoft Entra directory every 1, 3, 6, 12 or 24 hours. Replace key takes a new key for a sealed Tines connection. Update consent appears when a permission a consented directory gave is now refused, and asks its administrator to approve again. Revoke stops collection, after asking; what was collected is kept. For a consented directory the dialog names the app to remove in Microsoft Entra, because only the directory can withdraw its consent. Replacing a key and revoking ask you to verify your identity if you have not recently, and a personal access token can do neither. A sealed connection is overdue when it has not run for twice its interval, so 30 minutes for the default.

Where your deployment connects Tines from the console, Add a reporting source registers one Tines story to report what it does, in the Space its form names (the Space you are looking at, or the one Space you administer if that is all you have; if you change Space in another tab, the form checks again where the source lands before it adds anything): a name, the story's ID, how long its token lives (1, 7 or 30 days) and how often the story sends a heartbeat (every 5, 15 or 60 minutes). In Inventory, Report this story beside a story with an open coverage gap opens the same form with the story's ID filled in; reporting shows what the story does and does not govern or block it. Once a story has a source, its row names it and says whether it can report now: the gap stays open until inventory is next read, so a source you just added sits beside it and reads as able to report (a revoked connection's inventory is never read again, so beside its story the source says the gap stays open), while one whose token has expired says so and where to rotate it, or, in a Space you only review, that its administrators do. A story has one source in a Space that can take its events: for a story that already has one, rotate its token instead. A source that has kept its 10,000 events, which rotating does not reset, still takes its story's heartbeats; as its card says, add the story again while it stands and revoke it once the story reports through the new token, not before, because revoking cannot be undone and a full workspace refuses the new source, leaving the old one as it was. If ExecBound does not confirm a new source or a rotation, the dialog says it may have happened; look on Connections before trying again. The token is shown once, with the intake address and how to hold it in a Tines credential; copy it before you close the dialog, because it cannot be shown again. It authorizes intake only: it lets that one story send events about itself and cannot run actions, approve requests or read anything. After you close the token dialog, the source's card checks for the first heartbeat every 10 seconds for up to 10 minutes while the tab is visible, and says when the story is reporting. A story with a 15- or 60-minute heartbeat may not send its first within that time: the card says so, and the source is marked stale only 30 minutes or 2 hours after you added it. The page refreshes every 30 seconds, so the card updates whenever the heartbeat arrives. Rotate token issues a replacement, shown the same way, and keeps the previous token working for the grace you choose. A source keeps only one previous token, so rotating again while an earlier rotation's grace is running stops that earlier token at once, and the rotate dialog says so when it would. Revoke stops every token the source ever had at once and cannot be undone. In a Space where you review but do not administer, a source's card offers neither change and the form says it cannot add one there. Adding, rotating and revoking ask you to verify your identity if you have not recently. Where your deployment does not connect Tines from the console, a source is added from the command line, and you can still revoke one from its card.

Select Check connection to inspect retained collection evidence. A saved connection can still be waiting for its first sync, stale, revoked or failing. While it is waiting for its first sync, the check runs again every 10 seconds as long as the dialog is open and the tab is visible, for up to 10 minutes; Stop listening ends it sooner. Monitoring records visibility and coverage gaps; it does not confer execution authority.

On Connections, a connection reads Collecting in green only while its last run completed within a day (for a connection the collector opens itself, such as a sealed one, within twice its own interval if that is sooner), it has synced inventory within two days and no capability it needs is forbidden; the setup check uses the same rule. A connection no run has been recorded for in that time reads Collection overdue, with the time it fell due. Overdue connections and stale reporting sources are quiet, and they are listed first. Each connection also shows its Schedule, such as "Audit records every 15 minutes, inventory daily" for Tines or "Every 6 hours" for Entra, and when it is next due, or since when it has been due once that time has passed; a connection registered with an operator's key file is collected on that schedule only where the collector holds the file. While a run holds the connection it reads "Collecting now."

Work through findings

The count beside Monitoring in the sidebar is the number of open findings, and it opens them. When nothing is open but a source or a collection is quiet, the count is the quiet items, and it opens Connections at the first one. Home shows the same figures.

Findings lists the open findings by default; Acknowledged and All show the others, and the counts beside them include findings beyond the 200 shown. Each finding is one row: its title, what it is about (a directory agent, a reported action, a connection or a source), when it was recorded and its state. Show details opens the row in place with its rule, its facts and Acknowledge finding, with an optional note of up to 500 characters saying why; the note is shown under the acknowledgement, and one that looks like a password, key or token is refused. An acknowledgement cannot be undone, and a note cannot be added to a finding someone has already acknowledged. To acknowledge several open findings at once, tick them, or choose Select all open on this page (at most 50), add a note for them all if you like, and choose Acknowledge selected. Nothing is sent until you confirm the count in the sentence that replaces the button; the answer then says how many were acknowledged, how many someone had already acknowledged, and how many are not in the space you are viewing or no longer exist, with their titles. Acknowledging several at once needs a browser session; a personal access token acknowledges one finding at a time. A finding's address opens it directly, from another state or from a link elsewhere in Monitoring; a finding in a space you are not viewing is not shown, and switching to All spaces may find it. Findings are also sent to the email, Slack, Teams and webhook destinations the deployment's operator configures for findings. Monitoring → Alert settings lists those destinations by id, kind, host, rules and Spaces, a Space you cannot see counted and never named, and never an address or a secret, and the newest 200 deliveries with their destination and state; with none configured, it says findings are not sent outside the console (Operations).

To govern a directory agent a finding names, open it from Monitoring → Agents and choose Govern this agent, which opens the agent's page, where it can be governed or bound to an agent that already exists.

Monitoring → Agents is the list to work through: anything non-human that can act here, the actors that did something consequential outside ExecBound in the last 30 days first, then those with an open path, a live path to a consequential action that nothing governs and nobody accepted. Each row says who drives the actor and how that is known, or Unattributed; how many consequential actions it took in the last 30 days (At least when the directory's observation bound dropped repeats); and its governed, open and accepted paths. A row offers Govern this agent, Govern this action, which opens Policy, Accept for an actor with open paths, and Remove in Entra, which opens the Microsoft Entra admin center's enterprise applications with the application id to filter by: ExecBound never changes your directory. A Tines-driven row points at the Tines Gate recipe.

Accept lists the actor's open paths, all chosen, and takes a reason from five and an expiry of 30, 90, 180 or 365 days; only an open path is accepted, so one already accepted is withdrawn first, or accepted again once its acceptance expires. Accepting says the organization lives with the path for now: the path stays where it is and is still shown, it stops counting as open until it expires or is withdrawn, and its finding closes at the next collection. The agent's page shows every acceptance and withdrawal, and Withdraw on an accepted path. Accepting and withdrawing ask you to verify your identity if you have not recently, and a personal access token cannot do either. Every actor of the workspace is listed, but a path is accepted in its connection's Space: where you do not administer that Space, neither is offered, and the page says an administrator of its Space accepts or withdraws them.

Add a synthetic directory, under Connections, shows what Scout does with a directory before you connect your own: a fixed set of actors, drivers and actions that exists only in ExecBound, read on a schedule like a real directory, with a new actor an hour after its first collection. It is labelled Synthetic directory wherever it appears, nothing it finds is sent anywhere, and none of its actors can be governed or bound. It is offered only to a workspace administrator, since it holds for every Space, and only where no Microsoft Entra directory was ever connected in any Space; Connect Microsoft Entra, in any Space, waits until it is removed with Remove, which takes its actors off the lists, and a Space other than its own says it is in another Space. Its findings show on Monitoring alone: Home, the workspace settings, the Spaces page and the weekly summary do not count them. With no detection profile set, its actors are assessed against the built-in sensitive actions, so its findings, what each actor did and Accept all show at once; once a profile is set, it decides, and a real directory is never assessed without one.

On a Tines connection, Record egress takes the addresses your Tines tenant's HTTP requests leave from, as Tines shows them at /info on your tenant, at most eight; a directory actor that signs in from one is attributed to that Tines tenant. Recording them asks you to verify your identity if you have not recently.

Finding your way

Search (Ctrl K or Cmd K, or Search in the sidebar) finds pages by the words people use for them, such as "people" for Users, "tenant" for Workspace settings or "approvers" for Approval rules, and records by a request reference such as EB-1042, a case ID, a hostname or a provider id. With nothing typed it lists what you opened recently in this browser, and its commands open a page's own dialog, such as Add agent, with its usual checks. Where you are looking at one Space and nothing matches, Search all your spaces switches you to All spaces and searches again.

Press g then a letter to go to a page, such as g a for Approvals or g ? for Help; j and k move along the rows on Activity and Approvals, and ? lists every key. If you use speech input or press keys by accident, turn off Use single-key shortcuts in My account → Appearance or at the foot of that list; Ctrl K or Cmd K still opens search.

The bell shows a dot when something is waiting on you. Its Waiting on you section says how many approvals wait for your decision and when the soonest lapses, and, for an administrator, open monitoring findings, approvals waiting on other approvers and dispatches awaiting provider evidence, each with a link; below it is your sign-in security log. The tab's title names the page and counts the approvals waiting for you.

Signing in again

When your session ends, or you open a link while signed out, signing in brings you back to the page you were on, with its filters and the record you had open. A link that names something the console cannot return to takes you to where you usually start.

Two minutes before a session must end whatever you do, the top of the page says when: two days after you signed in, or, if you signed in with a setup credential, when that credential expires. It never extends the session and cannot be dismissed. Sign in again signs you in now and brings you back to the page. On a page that keeps what you type, such as a new policy document under Policies → Advanced or the comment on an approval, it says so, and what you typed is back after you sign in, in the same tab, for thirty minutes after you last typed in a policy document. A setup credential cannot be used once it expires, so its notice points you to Help on setting up your own sign-in instead.

A record's drawer has Copy reference, its request reference, and Copy link, the record's own address on Activity; an agent's page has Copy link too. A link opens the record only for someone who can already see it.

Working in several workspaces

If your account belongs to more than one workspace, the Workspace button at the top of every page opens Your workspaces: the one you are in first, then the ones you entered most recently, wherever you entered them, then the ones you opened last in this browser, then the rest. Each says your roles there and, where opening it asks nothing more of you, how many approvals wait there for you and how long the first has left; the button carries a dot when any do. Within thirty minutes of entering your code, a workspace that asks for a second factor opens without another, so it shows its count too. A workspace that would ask for your second factor, or for one to be set up, says so instead of a count, and one that only your organization's sign-in opens cannot be chosen here. Move with the arrow keys, choose with Enter, and close with Escape; past five workspaces you can type to filter them. Search offers the same switch under Workspaces.

A switch keeps your place: from Activity you land on Activity in the other workspace, or where you start there when it is a page your role there does not open. Records stay in the workspace they belong to, so a switch never opens the same record elsewhere. Other tabs you have open say which workspace they showed and where the browser is now, and their link opens the same page in the new one; after you sign in again to the same workspace, a tab offers to reload its own page. Every workspace numbers its own requests, so with several, a record names its workspace beside its reference, as in "EB-12 · Contoso SOC", and search names the workspace its records come from.

Signing in opens the workspace you used last. Signing in from a link to an approval in one of your workspaces opens that workspace instead, so you enter your code once and land on the approval. Switching within thirty minutes of entering your code takes that code with you: the other workspace opens without asking again, and the thirty minutes still count from when you entered it, so a change there that needs a recent code asks once they have passed. When a switch asks for your code, the page says which workspace it opens ("Verify to open Team"); if you enter a code you have just used, it says so, and that does not count toward the limit on failed attempts.

Account and workspace settings

My account contains your sign-in and personal settings. Workspace settings contains tenant-level controls. Keep the selected Space in view when configuring agents and sources; its data and permissions can differ from another Space.

When you enter your second factor at sign-in, you can tick Trust this browser for 30 days. That browser then skips the code when you sign in and when you open another of your workspaces, for thirty days. A change that needs a recent code still asks for one. My account → Trusted browsers lists every browser you trusted, marks This browser, and removes one or all of them without asking for a code. Changing your password or second factor, adding or removing a passkey, or Sign out other devices removes every trust. An administrator can turn trusted browsers off for a workspace under Account security; that workspace then asks for the code at every sign-in.

If you are an administrator, create your own bearer token for the console API under My account → Personal access tokens, with a name and a lifetime from one hour to 90 days or Never. If you have enrolled a second factor, it must have been verified in the last thirty minutes; if you have none enrolled, you are not asked for one. The token is shown once; save it before closing the dialog. It can read your own second-factor status under My account, and, as an administrator, every person's on Users, as you can. It acts as you, except that it can never decide an approval, loosen enforcement, change people, access or sign-in, or manage tokens or your own account. Revoke it from the same list, or from Workspace settings → Personal access tokens, which any administrator can use to revoke anyone's token in the workspace; revocation takes effect on the token's next request. A revoked or expired token can then be deleted from the list it was issued on.

Workspace settings → Approval readiness keeps the approval deadline and Change deadline, and says how long a held request can wait for each action the active policy can hold: at most the approval deadline, or, when the context runs out first, about as long as the facts the action reads stay valid, which an incident or inventory record does for five minutes by default. A request can wait less, because the time starts when the facts were recorded. With several Spaces and "All spaces" selected, each Space is listed by name; a Space with no active policy holds nothing. When the workspace enforces, a window is under ten minutes and nothing announces approvals, the card warns that held requests will lapse unless a reviewer is watching Approvals, and says how notifications are configured.

The same card lists where approvals are announced: each approval notification destination with its kind, host, Classes ("Approvals", or "Approvals, Findings" for one that also receives findings), approvers and Messages, "New requests", "Reminders" and "Outcomes" as its configuration lists them, or "Audit export" for the security event export, whose classes and approvers read "None". A destination that receives findings alone is listed on Alert settings instead. Under the table, a line says how many announcements were delivered in the last 7 days and how fast (half within, and nine in ten within, a given time once five have arrived), and how many were not sent because the approval would have lapsed first or could not be delivered. When you change the approval deadline, the dialog warns as you type if the deadline is under three times the time in which nine in ten notifications here arrived, or, before anything has been measured, if it is the 2-minute minimum and an email destination announces approvals; otherwise, for any deadline under ten minutes where something announces approvals, it warns that a message can arrive after the request lapsed, with the slowest delivery measured here. The warning never stops the change. Guided setup states the same delivery line after the deadline on its held sample, or that no approval destination is configured. A request's Technical details name each delivery by its message: "Delivery" for the announcement, "Reminder delivery" or "Outcome delivery" for a follow-up, and its timeline says "Reminder queued." or "Outcome message queued." rather than another review notification.

Changes to people, access, sign-in, credentials, approval rules, approvers, a space's members, your password and your tokens, activating a policy (including adding or refreshing the samples, which activates the starter policy) and changing the enforcement mode need your second factor, if you have enrolled one, to have been verified in the last thirty minutes. When it is older, the console asks in a dialog over the page, then finishes the change without leaving it, so a form you were filling in keeps what you typed. The dialog's first line names the change, such as "To revoke key 2 for Agent 3, confirm it is you.", using agents', keys' and people's numbers rather than their names. Enter an authenticator or recovery code, or, if you have saved a passkey under Account security and your browser supports passkeys, choose Use a passkey. One verification covers every protected change for thirty minutes, not only the one named. Cancel leaves the change undone.

My account → Multi-factor authentication shows whether your authenticator app is on, how many passkeys you have saved and how many recovery codes are left, and the workspace's requirement when it has one, with Add a second factor or Manage to Account security. Users has a Second factor column, and a person's page a Second factor line under Sign-in, reading Enrolled or None; they read the factor the step-up reads. If you administer a workspace without having a second factor, Home shows one card saying that your changes are not protected by one, until you choose Dismiss, which this browser remembers. A person's History has three headed parts, Decisions, Sign-ins and Administrative changes: a decision links to its record in Activity where you can open it, and an administrative change links to the policy, agent or person it was about.

Community access and optional samples

Workspace access does not expire; invitations and API keys expire on their own clocks. The optional safe example does not dispatch a provider or change live approvals, limits or execution state. A hosted workspace's capacity and demo downloads are documented with the hosted service, and Editions compares the two.