Open Policy Violations
Select Agent Governance from the left sidebar, then select Policy Violations. The page opens with three summaries above a per-event table. Use Time Range at the top to scope every summary and the table to the same window.
Summary at a glance
Above the violation table, the page shows three summaries:- Top 5 Policies: A ranked breakdown of the busiest match-category and agent combinations.
- Blocked & Alerted: A breakdown of how violations resolved, with the total in the center.
- Violations This Week: The seven-day count, a comparison against last week, and a per-day breakdown.
Top 5 Policies ranks match-category and agent combinations, not individual policy names. Read the table to find specific policies.
Filter results
Use the filters above the table to narrow the rows.- Time Range scopes to the last hour, day, week, or a custom window.
- Category scopes to a single activity type: Dangerous Command, File Access, MCP Tool Call, MCP Server, Skill, Session, Malware, or Secret.
- Agent scopes to one agent: Cursor, Claude Code, Codex, or GitHub Copilot.
Read a violation
Each row begins with an icon for the action the policy applied. Hover the icon to see whether the action was Blocked, Alert, or Ask. The following table describes the rest of the columns.Common triage workflows
Confirm a new policy is working
After you create a policy, ask one developer to perform an action that matches the policy. Set Time Range to the last hour and Agent to that developer’s agent. Confirm the violation appears with the expected Blocked, Alert, or Ask action.Investigate a single incident
Set Time Range to the suspected window. Browse the rows for the developer’s agent and user. Hover the Details cell to read the full command, file path, or MCP tool name.Spot patterns to write new policies
Filter on Category to find clusters of unsanctioned activity. For example, several MCP Tool Call rows from the same MCP server are a signal to add an MCP Server Access policy. A wide spread of Dangerous Command rows like the one below points to a missing Command Execution policy.
When no violations match
Policy Violations shows No Policy Violations found when nothing matched the current filters. If you expected matches to appear, work through the following checks:- Widen Time Range in case the filter window is too narrow.
- Check hook health on the developer machines you expect to govern. See Deploy hooks for Cursor or Deploy hooks for Claude Code.
- Confirm a policy exists for the activity you expected to match. See Write a policy to create one.
Next steps
Continue with the following pages:- See Read the Coding Agent Governance overview for how violations trend across your fleet.
- See Write a policy to add or refine patterns based on what you find.