Your organization chooses how strictly AgenShield acts on what it observes.
There are three modes, and the difference between them decides how a rollout
feels.
The three modes
The difference between
audit and enforce is what happens to activity no
rule covers:
- In
audit, unmatched activity is allowed. You are blocking a known list of bad things. - In
enforce, unmatched activity is denied. You are permitting a known list of good things.
enforce is stronger and much easier to get wrong — it blocks anything your
allow rules failed to anticipate. Get there via evidence, not on day one.
Mode is set per rule, not only per fleet
Your organization sets a default mode for the fleet — shown in the Frontegg Portal as Bundle mode on the Rules page — and an individual rule can override it.monitor, then
promote exactly one well-understood rule to enforce. It also works in reverse —
a rule explicitly marked monitor stays observation-only even when the fleet is
in enforce, which is useful for trialling a new rule.
Where to see the active mode
The Frontegg Portal is the authoritative view — under AgenShield → Enforcement (https://portal.frontegg.com/<environment>/agen/shielded/enforcement) — where the Rules page shows the fleet default
(Bundle mode) and flags every rule that is pinned to its own mode — filter
the table by Enforcement to see exactly what is blocking today.
On a device, agenshield status confirms whether enforcement is active at all.
If a device reports that enforcement is paused or degraded, that is a health
problem rather than a mode setting — see
Common issues.
What a developer sees when something is blocked
A blocked action fails like an ordinary permissions problem — there is no AgenShield dialog in the terminal:
Every block is recorded with the rule that caused it. If a block is wrong, that
record is what your administrator needs — send it to them rather than working
around it.
See Rules and policy for how a rule is authored and
how the Enforcement column tells you which rules are pinned.
Skills, extensions, and connectors
The same three modes apply to the skills and connectors an agent loads, and they can be set separately from the rest of policy. That lets you enforce a strict skill allowlist while the rest of the fleet stays in monitor, or the reverse. One deliberate exception: if skills are set tomonitor, AgenShield will not
remove or quarantine skill files, even for a rule that asks it to. Monitor means
observe — it never destroys anything on disk. To enforce one high-risk skill rule
while staying broadly permissive, leave the skills mode at audit and promote
that single rule.
What is never blocked, in any mode
Regardless of mode or policy:- macOS system processes and system paths can never be denied. Those limits are compiled into the signed security extension — no configuration file, API, policy field, or administrator can change them.
- Your own account is not subject to the agent policy envelope. Enforcement is scoped to AI agents.
- If AgenShield starts denying an unexpected volume of ordinary system activity, it stands itself down automatically and allows everything for a cooling-off period.
Requesting a change
Enforcement is managed centrally — there is no local override on the device, by design. To get a rule relaxed or an agent approved, send whoever administers AgenShield the blocked-activity record from the Frontegg Portal.Next
Rollout playbook
How to move from monitor to enforcement without breaking workflows.
Privacy and data handling
What is recorded and what leaves the device.
Rules and policy
Authoring rules, and which ones are currently enforcing.
Agent resources
How the modes apply to the skills and connectors agents load.