GuardRail Control Plane

Estate Health

Actions governed

0

Allowed

0

Held for approval

0

Denied by policy

0

Awaiting approval

0

Approved by human

0

Denied / expired

0

Agents online

0

Live Activity

most recent agent actions

Time	Agent	Action	Target	Decision	Policy

Awaiting approval

Recently decided

who approved, denied — or let it expire

Event	Agent	Action	Outcome	By	When

Audit Trail

Agent Registry

Agent	Provider	Environment	Owner	Risk	Actions	Pending	Connected via	Last seen	Status	Control

Policy rules

For each action GuardRail checks the agent's own rules first, then the rules for all agents, top to bottom — the first match decides. Active compliance frameworks are checked too, and the stricter result wins, so a framework can't be weakened by a custom rule. New rules go to the top of their list; use ↑↓ to reorder. No match → default decision:

Order	Rule	Applies to	Matches	Decision	Timeout	Manage

Test a rule

see exactly what GuardRail would decide — nothing is recorded

Agent

Action

Target

Parameters (JSON, optional)

Compliance Frameworks

selected frameworks tighten gating on every action

Turning a framework on loads its stricter policy set. Actions that were allowed may now be held or denied, and each decision is tagged with the framework that made it. Every change here is written to the audit trail with the name of the person who made it.

Enforcement by framework

live evidence counts

Framework / rule set	Allow	Hold	Deny	Approved	Human-denied	Expired

Evidence report

for auditors, risk committees and GRC platforms

A printable report covering ledger integrity, enforcement per framework, the agent registry, every governance change (with who made it) and the action ledger with human outcomes. Open it and use your browser's Print → Save as PDF to file it. Vanta and Drata can receive it automatically — see Integrations.

Raw ledger exports (CSV)

for spreadsheets, SIEMs and GRC tools

Ledger integrity

1 · How it's built2 · Which agent3 · Install & paste4 · Verify

How is the agent built or where does it run?

any vendor, any cloud, any framework — pick the closest match

Already running in AWS Bedrock, Azure OpenAI or OpenAI and want GuardRail to find it?

Alerts & ticketing

holds, denials, approvals, expiries, escalations and the emergency stop

GRC evidence sync

Delivery log

last 100 deliveries

When	Integration	Event	Result	Detail

Users

User	Role	Sign-in	Status	Last sign-in	Created by	Manage

viewer — dashboards, trail, reports · approver — viewer + approve/deny held actions · admin — everything incl. agents, policies, users, frameworks, integrations and the emergency stop. SSO users are created on first sign-in (Settings → Single sign-on).

System check

Checks every configured service against the real endpoint with the saved credentials. Read-only unless you send test alerts.

Area	Check	Result	Detail	How to fix
Not run yet.

General & approvals

Organisation name

Shown on evidence reports.

Public URL

Used for links in alerts and for SSO. The address people open the console at.

Approval timeout (min)

Held actions auto-deny after this. 0 = never. Rules can override.

Reminder every (min)

Re-alert while a hold waits. 0 = off.

Escalate after (min)

Pages PagerDuty / alerts once. 0 = off.

Approval valid for retry (min)

After approval the agent can retry the identical call once within this window.

GRC sync every (hours)

Vanta / Drata evidence upload. 0 = manual only.

Default decision

When no rule matches.

Single sign-on (OpenID Connect)

Microsoft Entra ID, Okta, Google, Auth0, Ping, Keycloak

Enable SSO sign-in

Issuer URL

Client ID

Client secret

Redirect URI (register this at the IdP)

Allowed email domains

Role for new users

Group claim

Admin groups

Approver groups

Viewer groups

Button label

Group → role mapping is applied at every sign-in, so changing someone's group at the identity provider changes their GuardRail role. Keep at least one local admin (or the admin token) as break-glass.