Frequently Asked Questions (FAQ)
Answers to common questions about how Agent Identity Security works, what it stores, and how to manage agents, policies, and API keys.
- What does a Critical risk score mean for an agent?
- Critical is the highest risk level in Agent Identity Security. It means the agent has one or more factors that together indicate a serious and active security exposure — for example, an open connection to an unapproved server, combined with broad data access and no ownership assigned. Critical agents should be reviewed and remediated before the end of the working day. The risk score is recalculated continuously, so it will drop when the contributing factors are addressed.
- How often does Agent Identity Security refresh agent data from connected platforms?
- Agent Identity Security syncs with each connected platform on a scheduled basis. For most platforms, this is every 15 minutes. Coding agents using the Guardian report in near-real time when a session starts or ends. You can also trigger a manual sync for a specific integration from the integration settings page.
- Can I connect more than one integration of the same platform type?
- Yes. You can add multiple integrations of the same type — for example, two separate Microsoft Copilot Studio environments, each with its own credentials. Agents from all connected environments appear together in the Registry and are tagged with their source integration for filtering.
- What is the difference between Agent Posture and Event Logs?
- Agent Posture shows open security and compliance issues — things that are wrong with how an agent is configured or what it is allowed to access. These are persistent findings that need remediation. Event Logs shows a chronological record of actions — things that happened, including blocked requests, policy evaluations, and session events. Use Posture to understand the state of your agents; use Event Logs to understand their behavior over time.
- What happens to existing data when I delete a policy?
- Deleting a policy removes the enforcement rule immediately — any connection it was blocking is unblocked from that point forward. Historical event records showing that the policy blocked or allowed requests in the past are retained in Event Logs and are not deleted. If you want to keep the rule but stop enforcing it temporarily, use the Disabled status rather than deleting the policy.
- How do I rotate an API key used by a Guardian installation?
- Generate a new API key in Settings > API Keys with the same scopes as the key you are replacing. Copy the new key, then re-run the Guardian installer on each affected workstation and provide the new key when prompted. Once all workstations have been updated, delete the old key to prevent it from being used.
- Can Agent Identity Security block an agent from running entirely, not just from specific resources?
- Agent Identity Security enforces policies at the resource level — it can block or gate access to specific MCP servers, files, packages, web addresses, or terminal commands. It does not shut down or kill agent processes. If you need to prevent an agent from operating at all, the most effective approach is to remove its credentials from the source platform, which will cause authentication failures when it attempts to connect to any resource.
- Does Agent Identity Security store the content of agent requests and responses?
- Agent Identity Security logs metadata about each event — who, what resource, what action, and what the policy outcome was. It does not store the full content of agent requests or model responses unless your tenant has content capture enabled as part of a compliance configuration. Contact your AppViewX account team to understand what your specific tenant captures and retains.
- Who should I contact if none of these steps resolve my issue?
- Open a support case through the AppViewX Support Portal. Include your Agent Identity Security version (visible in Settings > About), the integration or feature involved, and the exact error message or behavior you are seeing. For critical production issues, use the Priority: Critical ticket level for fastest response.
