> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guardway.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# People

> The endpoint fleet regrouped by person — what each employee installed, asked, was stopped from doing and spent — and how machines are matched to directory people.

## What this is for

**People** shows the same fleet as [Fleet](/endpoint-ai-risk/fleet), one row per person instead of
one per machine. Use it to answer "who is using AI, through what, and what did it cost" and to see
one person's AI use across every machine they sign in to. Open it under **Endpoint AI Risk ›
People**.

Machines are matched to directory people by their Microsoft Entra device name or by username. A
machine no rule can tie to a person stays listed under its OS username until an administrator
links it.

## Options

### Filters

| Tab | Shows |
| - | - |
| **Using AI** | People with AI activity in the window. |
| **In the directory** | Everyone synced from your directory, whether or not a machine reports for them. |
| **Machines not matched** | Machines reporting to Guardway that no rule could tie to a directory person. Link one to move it to that person. |
| **No Guardway** | Directory people with no machine reporting. Their AI use is not visible. |
| **Open** | People with an open item to review. |

The search box matches a name, email or host. **All departments** narrows the list to one
department when your directory carries one.

### Columns

| Column | What it shows |
| - | - |
| **Person** | Display name and email, or the OS username for an unlinked machine. |
| **Machine** | The machines matched to the person. |
| **Activity · 30d** | Requests over the last 30 days. |
| **Routed** | The share of requests that went through your gateway. |
| **Stopped** | How many actions or requests a rule stopped. |
| **Consumption**, **Company spend** | Tokens, and the spend attributed to the organization. |
| **What stands out** | The signals worth a look: personal accounts, flagged assets, unattended agents. |

## A person's page

Click a person to open their page. The tabs are:

| Tab | What it shows |
| - | - |
| **Overview** | Where their requests went (gateway, direct, stopped) and a day-by-day chart. |
| **Activity** | Requests, distinct models, nights and weekends, sensitive data in prompts, the share that skipped the gateway, compared with the organization. |
| **Assets** | The skills, MCP servers, plugins and extensions installed on their machines, with each one's authorization: awaiting review or blocked org-wide. |
| **Stopped** | Every stop, grouped by the rule that fired and by the layer that stopped it (Live guard, the gateway, AI Control). Evidence is redacted before it leaves the machine. |
| **Machines** | Each of their machines with its Endpoint AI Policy, AI Control state, gateway key, last scan and 30-day spend. |
| **Cost** | Spend reported by the machines and through the gateway per tool, over today, 7 days or 30 days, and tools billed in credits. |

## Linking a machine to a person

On an unmatched row choose **Link**, enter the person's **Work email** and, optionally, a display
name. From then on that machine's activity appears under the person, and future machines with the
same username match automatically. Linking needs the **Owner** or **Admin** role.

## Limits

* Directory sync (Microsoft Entra, Okta, Active Directory) is set up under [Integrations](/platform/settings/integrations). Without it, every person is an OS username.
* A person whose machines run an older agent shows blank values for columns that agent does not report.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.