Policy and risk detection

Policy & risk detection Every outbound AI request is scanned before it leaves, by layered detecto...

This is the rule the Gateway applies to an MCP server that has no explicit rule of its own. Set i...

Turn on Require approval for new MCP servers when you want unknown servers held back until someon...

The risk classifier inspects outbound prompts for things that shouldn't leave — secrets, personal...

Off by default, and the setting that deserves the most thought before you turn it on. What it doe...

Policy → Egress blocklist controls which network destinations the Endpoint Suite allows AI tools ...

Several things can have an opinion about a single request. This is the order they are consulted, ...

Stops credentials from leaving your organization inside a prompt. Default: warn. This is the dete...

Catches credentials that do not match a known vendor format — internal tokens, database passwords...

Flags personal data appearing in prompts. Default: report. What it detects Email addresses Intern...

The one detector that is about a combination rather than a thing. Default: warn. The idea An AI a...

A model, rather than a pattern, judging whether a request is being manipulated. How it runs The c...

Per tool, whether requests run on the developer's own AI subscription or on your organization's p...

How long a developer's machine may keep working without signing in again. The two settings Policy...

Policy → Local MCP decision cache (seconds), from 0 to 3600. What it controls When an AI tool cal...

When the classifier stops a conversation, it appears at the bottom of the Policy screen — and thi...

How long Sentilai keeps your audit events, findings and any captured prompt content. Where it is ...

On Policy → Ungoverned AI agents you choose what happens when an autonomous AI agent Sentilai doe...