Troubleshooting Policy Denials
If your agent attempts an action and it's blocked, that's Gatekeeper's policy engine working as intended — not an error. Here's how to understand why it happened and what to do about it.
Step 1: Check the audit log
Every blocked action is logged with the specific policy that caused the denial. Go to Audit Log, find the action in question, and you'll see:
- What the agent tried to do
- Which policy evaluated it
- Why it was denied (or flagged for approval)
This is the fastest way to understand what happened — you shouldn't have to guess.
Step 2: Decide if the denial was correct
Most denials are the policy doing exactly what you set it up to do — for example, blocking a delete action you deliberately restricted. If that's the case, no action is needed; this is the system protecting you as intended.
Step 3: If the action should actually be allowed
If you've reviewed the denial and decide the agent should be able to do this going forward:
- Go to Policies.
- Find the rule that caused the denial (the audit log entry will point you to it directly).
- Adjust the rule — either loosen the condition, or change the outcome from Deny to Allow or Require approval.
- Save. The updated policy applies to future attempts immediately; it does not retroactively apply to the blocked action.
A note on "Require approval" vs "Deny"
If you're unsure whether an action should always be allowed, switching a Deny rule to Require approval is often a safer middle step — it lets you review and manually approve each instance while you build confidence, rather than fully opening it up right away.