Agent Approvals
The Approvals page is available on the Growth and Business plans, and during the 14-day trial.
Approvals are Sielum's review queue for newly discovered AI agents. Every time an agent appears on an endpoint for the first time, it lands here as a pending request, so an admin can decide whether that tool is sanctioned in your organization.
How it works
- An endpoint reports an AI agent that has not been seen before in your tenant
- Sielum creates a pending approval request for that agent
- An admin opens Approvals in the dashboard and reviews it
- The admin approves or rejects the request, optionally with a note
- Approving adds the agent's name to the
allowed_agentslist of yourunknown_agentpolicy, so the tool stops producing unknown-agent alerts
If no unknown_agent policy exists yet, approving an agent creates one automatically with
severity: high and enabled: true.
Rejecting an agent does not block it, quarantine it, or stop it from running. Nothing on the endpoint pauses waiting for your decision. The queue documents which tools you have reviewed and keeps your allowlist in sync.
To actually prevent a tool from working, use Tool Permissions, Config Guard, or a Firewall rule.
Approval states
| State | Meaning |
|---|---|
pending | Not yet reviewed |
approved | Reviewed and sanctioned — the agent name is added to the allowlist |
rejected | Reviewed and marked unwanted — record only, no enforcement |
There is no timeout: a pending request stays pending until someone acts on it.
Reviewing approvals in the dashboard
- Navigate to Approvals in the left sidebar, under Activity
- The Pending list shows each request with the agent name, hostname, endpoint, and when it was first seen
- Optionally click Add note to record why you are approving or rejecting
- Click Approve or Reject
Reviewed requests move to a second list below, with the reviewer and the note preserved. Approvals require an admin role.
Turning an approval decision into enforcement
The approval queue tells you which tools exist. Acting on that knowledge happens elsewhere:
| Goal | Where |
|---|---|
| Stop alerting on a sanctioned tool | Approve it — the unknown_agent allowlist updates automatically |
| Keep alerting on an unwanted tool | Leave it unapproved; the unknown_agent policy keeps firing |
| Restrict what a tool may do | Tool Permissions and Config Guard |
| Cut a tool off from its API | Firewall rule (device-wide) |