Fleet

Fleet lists every machine running the Guardway agent in your organization: who uses it, which AI tools run there, how its AI traffic is governed, and what needs attention. Open it in the console under Endpoint AI Risk › Fleet. The page loads 100 machines at a time; use the pager under the list for the rest. The search box matches anything shown in the table.

A blank value (—) means the machine has not reported that information, usually because its agent is older. Unknown is never shown as zero or as an all-clear.

Summary

The cards above the list describe the whole fleet: how many machines are online and at risk, open incidents, the share of AI traffic that went through your gateway, how many machines are signed in to personal AI accounts, and the fleet’s overall risk. Trends cover the last 30 days and are the same for everyone in your organization.

Columns

Choose which columns show from the column picker. Settings are kept per browser.

Column	What it shows
Endpoint, User, OS	The machine, the person signed in to it, and its operating system.
Sensor	The agent version and whether it is up to date.
Status	Online, or when the machine last reported.
Security features	Which protections are on: at-rest scan, threat lists, live guard, behavior, approval baseline, telemetry. Hover a mark for details.
Policy	The Endpoint AI Policy version the machine is running.
Personal / Corporate	AI accounts signed in on the machine, split by personal and corporate.
Posture	How AI traffic is handled (see below).
Risk	The machine’s risk score.
OWASP AST	Coverage of the OWASP Agentic Skills Top 10. Hover to see all ten items.
Gateway traffic	The share of AI calls that went through your gateway (see below).
Spend 30d, Tokens 30d	AI spend and tokens over the last 30 days.

Posture

Observe: traffic is watched and recorded. Nothing is stopped, even when a rule matches.
Enforce, fail-closed: traffic goes through your gateway. If the gateway cannot serve, the call is blocked.
Enforce, fail-open: traffic goes through your gateway. If the gateway cannot serve, the call goes straight to the AI vendor, ungoverned.
Enforce, fail mode ?: the agent is too old to report what happens when the gateway is down.

You set posture in the Endpoint AI Policy.

Gateway traffic

Every AI call from the last 30 days, split four ways. Only the first two were governed:

Relayed through the gateway
Stopped by the gateway
Vendor fallback (fail-open): the gateway could not serve, so the call went to the vendor directly.
Observed only: the call never went through the gateway.

A routed Claude Code turn counts once.

Filters

Filter	Shows machines that
Needs attention	are at high or critical risk.
Observe only	record AI traffic but do not enforce.
Unattended agents	ran AI agent sessions with no one at the keyboard.
Personal accounts	are signed in to a personal AI account.
Flagged artifacts	have a flagged skill, MCP server or other AI artifact installed.
Unknown model API	have an AI tool sending an API key to a host that is neither Guardway nor a known AI vendor, for example a third-party proxy or a self-hosted model exposed to the internet.
Off-policy API	have an AI tool set up to call a model API your Endpoint routing does not allow. Your platform gateways and local model runners such as Ollama always count as allowed. Under Require Guardway gateway, a direct call even to an approved vendor is off-policy. If your organization has not published Endpoint routing, no machine is judged.
Offline	have not reported recently.

A machine’s details

Click a machine to open it. You see the findings on that machine, the AI tools and accounts in use, and links to its skills and tools in Inventory, to the person, and to any open incident in AIDR.

Machine actions

Owners and admins see up to three actions, from least to most drastic:

Action	What it does	Afterwards
Revoke gateway key	Cancels the key this machine uses to send AI traffic through your gateway. No other machine is affected.	Temporary. The machine gets a new key on its next policy check-in and relaying resumes by itself. Until then, the policy’s fail mode decides whether its calls fall back to the vendor or are blocked. Use it when a key may have leaked.
Revoke device access	Cancels this machine’s credential for reporting to Guardway.	Permanent. The machine stops reporting and does not recover on its own; it cannot enroll again until you remove it. Use it for a lost, stolen or retired device.
Remove endpoint	Deletes the machine and all its reports and findings.	Cannot be undone. If the agent is still installed and enrolled, the machine reappears on its next report. Use it to clean up old or duplicate entries.

To cut a machine off for good, Revoke device access first, then Remove endpoint. Removing alone only clears its history.

Revoke gateway key only appears for machines that hold a gateway key Guardway issued. Revoke device access only appears for machines on a per-device credential.

Getting Started

Platform

Gateway

Discovery

Resources

API Reference

Summary

Columns

Posture

Gateway traffic

Filters

A machine’s details

Machine actions

​Summary

​Columns

​Posture

​Gateway traffic

​Filters

​A machine’s details

​Machine actions

Summary

Columns

Posture

Gateway traffic

Filters

A machine’s details

Machine actions