Keeper EPM Agentic AI Governance
Discover known and possible AI agents across monitored endpoints. Use agentic policy types to govern agent launch, agent actions and elevation requests with allow, deny, approval, MFA, justification and human-in-the-loop controls.
Keeper Endpoint Privilege Manager applies a consistent enforcement model across the AI agent lifecycle. Agentic AI Policy controls whether an agent may run, Agentic Access Policy governs matching actions after launch and Agentic Privilege Elevation Policy handles requests for administrative rights.
The Agentic AI Policy decides whether a recognized agent may run at all. Allow or deny it outright, or require administrator approval, end-user approval, MFA or justification before the process starts.
The Agentic Access Policy controls matching actions after an agent is running, including access to sensitive files, command-line or privileged operations and protected resources. Allow, deny or gate each action with approval, MFA or justification.
The Agentic Privilege Elevation Policy inserts a decision point whenever an agent requests administrative rights. Allow or deny the elevation, require administrator or end-user approval or add MFA and justification controls.
Every governed launch, action and elevation request follows a consistent policy path.
Known Agents match signatures such as process name and path, publisher or certificate, binary hash and network fingerprint. Unknown processes are scored 0–100 by behavioral heuristics and surfaced as Possible Agents.
EPM evaluates the agent against the policy's User, Machine, Application and Agentic AI Collections, plus any configured date and time constraints, to determine whether the event matches.
Apply Allow or Deny as a standalone outcome, or combine administrator approval, end-user approval, MFA and justification. When controls are stacked, every requirement must be satisfied.
Every governed launch, action, or elevation request is recorded whether it is allowed, denied or held. Security teams can audit agent activity against the policy baseline.
Known Agents are matched by signature: process name and path, publisher or certificate, binary hash and network fingerprint. Possible Agents are scored 0–100 by behavioral heuristics. Administrators can also flag any application as Agentic AI.
Set a minimum AI-likelihood threshold for policy controls. You can allow low-confidence detections silently while requiring approval, MFA or justification above the threshold, based on your risk tolerance.
All three agentic policy types default to Monitor mode. Observe matches and potential outcomes, then tune collections, thresholds and controls before switching to Monitor & Notify or Enforce.
Require User Approval prompts the endpoint user to approve or deny an agent launch, action or elevation request in real time. A "Don't ask again" window can reduce repeated prompts.
Require Approval, Require User Approval, Require MFA and Require Justification can be combined; every configured requirement must pass. Allow and Deny are mutually exclusive and always stand alone.
Every governed agent, action and elevation request is recorded against the policy baseline—whether allowed, denied or held—so teams can audit activity regardless of the enforcement outcome.
Target User, Machine, Application and Agentic AI Collections. Saved policies reach in-scope endpoints within approximately 30 minutes, or immediately through Refresh Policies in the Keeper agent.
Agentic AI Policy decides whether an agent may run. Agentic Access Policy governs matching actions after launch. Agentic Privilege Elevation Policy handles requests for administrative rights. All three use the same allow, deny, approval, MFA, justification and end-user approval controls.
Known Agents match signatures. Unknown processes are scored 0–100 by behavioral heuristics and surfaced as Possible Agents when their behavior resembles an AI agent. Administrators can also flag any application as Agentic AI.
Yes. Start in Monitor mode, then use Allow and AI-likelihood thresholds to let approved or low-risk agents operate without added friction. Higher-risk matches can require approval, MFA or justification.
Begin in Monitor mode to observe matches and potential outcomes without enforcing controls. Tune scope, collections and thresholds using real activity, then move to Monitor & Notify or Enforce. Saved policies reach endpoints within about 30 minutes, or immediately through Refresh Policies.
عليك تمكين ملفات تعريف الارتباط لاستخدام الدردشة المباشرة.
