> ## Documentation Index > Fetch the complete documentation index at: https://docs.guardway.ai/llms.txt > Use this file to discover all available pages before exploring further. # Fleet > Every machine running the Guardway agent in one list, what each column and filter means, and what the machine actions do. **Fleet** lists every machine running the Guardway agent in your organization: who uses it, which AI tools run there, how its AI traffic is governed, and what needs attention. Open it in the console under **Endpoint AI Risk › Fleet**. The page loads 100 machines at a time; use the pager under the list for the rest. The search box matches anything shown in the table. A blank value (**—**) means the machine has not reported that information, usually because its agent is older. Unknown is never shown as zero or as an all-clear. ## Summary The cards above the list describe the whole fleet: how many machines are online and at risk, open incidents, the share of AI traffic that went through your gateway, how many machines are signed in to personal AI accounts, and the fleet's overall risk. Trends cover the last 30 days and are the same for everyone in your organization. ## Columns Choose which columns show from the column picker. Settings are kept per browser. | Column | What it shows | | - | - | | **Endpoint**, **User**, **OS** | The machine, the person signed in to it, and its operating system. | | **Sensor** | The agent version and whether it is up to date. | | **Status** | Online, or when the machine last reported. | | **Security features** | Which protections are on: at-rest scan, threat lists, live guard, behavior, approval baseline, telemetry. Hover a mark for details. | | **Policy** | The Endpoint AI Policy version the machine is running. | | **Personal** / **Corporate** | AI accounts signed in on the machine, split by personal and corporate. | | **Posture** | How AI traffic is handled (see below). | | **Risk** | The machine's risk score. | | **OWASP AST** | Coverage of the OWASP Agentic Skills Top 10. Hover to see all ten items. | | **Gateway traffic** | The share of AI calls that went through your gateway (see below). | | **Spend 30d**, **Tokens 30d** | AI spend and tokens over the last 30 days. | ### Posture * **Observe**: traffic is watched and recorded. Nothing is stopped, even when a rule matches. * **Enforce, fail-closed**: traffic goes through your gateway. If the gateway cannot serve, the call is blocked. * **Enforce, fail-open**: traffic goes through your gateway. If the gateway cannot serve, the call goes straight to the AI vendor, ungoverned. * **Enforce, fail mode ?**: the agent is too old to report what happens when the gateway is down. You set posture in the [Endpoint AI Policy](/discovery/endpoint-ai-policy). ### Gateway traffic Every AI call from the last 30 days, split four ways. Only the first two were governed: * **Relayed through the gateway** * **Stopped by the gateway** * **Vendor fallback (fail-open)**: the gateway could not serve, so the call went to the vendor directly. * **Observed only**: the call never went through the gateway. A routed Claude Code turn counts once. ## Filters | Filter | Shows machines that | | - | - | | **Needs attention** | are at high or critical risk. | | **Observe only** | record AI traffic but do not enforce. | | **Unattended agents** | ran AI agent sessions with no one at the keyboard. | | **Personal accounts** | are signed in to a personal AI account. | | **Flagged artifacts** | have a flagged skill, MCP server or other AI artifact installed. | | **Unknown model API** | have an AI tool sending an API key to a host that is neither Guardway nor a known AI vendor, for example a third-party proxy or a self-hosted model exposed to the internet. | | **Off-policy API** | have an AI tool set up to call a model API your [Endpoint routing](/discovery/endpoint-ai-policy#endpoint-routing) does not allow. Your platform gateways and local model runners such as Ollama always count as allowed. Under **Require Guardway gateway**, a direct call even to an approved vendor is off-policy. If your organization has not published Endpoint routing, no machine is judged. | | **Offline** | have not reported recently. | ## A machine's details Click a machine to open it. You see the findings on that machine, the AI tools and accounts in use, and links to its skills and tools in **Inventory**, to the person, and to any open incident in **AIDR**. ### Machine actions Owners and admins see up to three actions, from least to most drastic: | Action | What it does | Afterwards | | - | - | - | | **Revoke gateway key** | Cancels the key this machine uses to send AI traffic through your gateway. No other machine is affected. | Temporary. The machine gets a new key on its next policy check-in and relaying resumes by itself. Until then, the policy's fail mode decides whether its calls fall back to the vendor or are blocked. Use it when a key may have leaked. | | **Revoke device access** | Cancels this machine's credential for reporting to Guardway. | Permanent. The machine stops reporting and does not recover on its own; it cannot enroll again until you remove it. Use it for a lost, stolen or retired device. | | **Remove endpoint** | Deletes the machine and all its reports and findings. | Cannot be undone. If the agent is still installed and enrolled, the machine reappears on its next report. Use it to clean up old or duplicate entries. | To cut a machine off for good, **Revoke device access** first, then **Remove endpoint**. Removing alone only clears its history. **Revoke gateway key** only appears for machines that hold a gateway key Guardway issued. **Revoke device access** only appears for machines on a per-device credential. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.