Skip to content

Managing Agents

Agentic Fabric provides a registry of enterprise, endpoint, and browser agents used across your organization with visibility into their activity and relationships across humans, agents, machine identities, and resources. On the Agent Registry page, you can manage the ownership of agents, organize them by their associated business app, and access their identity graphs.

You can view and manage the following types of agents in Agentic Fabric:

  • Enterprise: An autonomous or semi-autonomous agent that executes multi-step workflows across systems, discovered through dataset aggregations. These agents can be activated and deactivated with approvals from SailPoint Agentic Fabric.
  • Endpoint: An agent running on a user's computer or laptop, discovered through SailPoint Endpoint Agent Security. These agents are installed locally by end users and can be blocked or unblocked by administrators.
  • Browser: An agent discovered through SailPoint Browser Agent Security.

Viewing the Agent Registry

You can review the agents discovered and registered from connected agentic platforms, browsers and endpoints, and SaaS applications in the agent registry.

To view the agent registry:

  1. Go to Agentic Fabric.

  2. From the navigation menu, go to the Non-Human Identities section and select Agents.

    Select the quick filters on the Agent Registry page to refine the agents listed in the table. You can view agents discovered in the last 30 days as well as those marked as unsanctioned or missing an owner. On the All Agents and Discovered quick filters, you can hover over the line graph to view the agent count by day.

    Additional filtering can be applied by selecting + More. Select Clear All Filters to clear all configured filters.

From the agent registry, you can review the following information about each agent:

  • Owners: The agent's primary owner and additional owners.
  • Agent Type: Indicates the type of agent. An agent can be an enterprise, endpoint, or browser agent. If an agent is newer, its Agent Type may be listed as Unknown.
  • Business App: The business app the agent is associated with. The business app may display a warning if the app is unsanctioned by your organization.
  • Status: Indicates whether the agent is active or inactive. You can change the status of an agent by activating or deactivating it.

Viewing an Agent's Details

You can access an AI agent's details page to view additional data about the agent, including its attributes, user entitlements, and change history.

To access an agent's details page:

  1. Go to Agentic Fabric.

  2. From the navigation menu, go to the Non-Human Identities section and select Agents.

  3. Find and select an AI agent to view its details page.

From this page, you can perform the following actions:

  • View and copy the agent's attributes in the Details tab.
  • View the user entitlements that grant identities access to the agent in the Details tab. You can also select a user entitlement to view further information about it, including the identities that receive access to the agent through the user entitlement.
  • Review the agent's identity graph in the Access tab.
  • Review the entitlements assigned to the agent's correlated non-human accounts in the Access tab.
  • View the identity intelligence for the agent, including the humans and governance groups associated with it, in the Intelligence tab.
  • View and update the non-human accounts correlated to the agent in the Accounts tab.
  • Review the details and risk level of any risks associated with the agent in the Risk tab.
  • View the abilities an agent can use or perform (MCP clients, tools, skills, or plugins) in the Capabilities tab.
  • Review changes in the Change History tab.
  • Update the agent by selecting the Actions menu in the upper-right corner of the page.

Viewing an Agent's Identity Intelligence

You can view identity intelligence for an agent, including the humans and governance groups associated with it, who owns the agent, and who is authorized to use it.

Viewing Associated Humans

You can view the primary owner, secondary owners, other authorized human users, and governance groups associated with an agent.

  1. Go to Agentic Fabric.

  2. From the navigation menu, go to the Non-Human Identities section and select Agents.

  3. Select an agent.

  4. Select the Intelligence tab.

  5. In the In this brief section, select Associated Humans.

The Associated Humans section displays:

  • How many associated humans and governance groups use the agent.

  • The relationship for the associated human or governance group, such as Primary Owner, Authorized, or Governance Group.

You can view identity intelligence for an associated human from the same tab.

To view intelligence for an associated human:

  1. On the Intelligence tab, find the associated human.

  2. Select View Details.

For a human identity, the response can include:

  • Core identity details, such as display name, email, login alias, and identity status.

  • Correlated accounts, including disabled and locked state.

  • Privileged access items and privilege level.

  • Rare access outliers, for organizations that have Access Insights.

  • Access history, including grants, removals, account status changes, and certification events.

  • Non-human identities the person owns.

  • A link to the identity's identity graph, for organizations that have the Identity Graph feature.

Refer to SailPoint SecOps Identity Intelligence for more information about the identity context returned for a human identity.

Reviewing Impact

You can view the power an agent has, including impacted sources and the number of authorized humans.

  1. On the Intelligence tab, in the In this brief section, select Impact.

  2. Review What power does this identity have, including impacted sources and authorized humans.

Accessing an AI Agent's Identity Graph

You can access an agent's identity graph to visualize the agent's relationships across human identities, machine identities, entitlements, and other access items.

  1. Go to Agentic Fabric.

  2. From the navigation menu, go to the Non-Human Identities section and select Agents.

  3. Find or search for an agent.

  4. Select the View in Identity Graph icon .

You can now review the agent's relationships and identify possible risks through visualization.

Updating AI Agents

If an agent's owner leaves your organization, you can update the agent to change its primary owner and add additional owners for succession planning. An agent's description and user entitlements can also be updated.

To update AI agents:

  1. Go to Agentic Fabric.

  2. From the navigation menu, go to the Non-Human Identities section and select Agents.

  3. Find the agent that requires updates and select Actions > Update Identity.

    To update multiple agents, select the checkboxes next to the agents that require updates and then select Update Identities. You can select up to 100 agents at a time.

    Note

    When you update the attributes for multiple agents, an agent's existing attributes will be replaced with your changes. For example, if an agent is included in a bulk update that adds a user entitlement or additional owner, the new entitlement or owner assignment replaces the agent's existing assignments.

  4. Update the attributes.

  5. Select Save to save these changes.

    The update might take some time depending on the number of agents selected. After an agent has been updated, its manuallyEdited status is changed to true.

Activating AI Agents

You can activate an agent your organization has started using. Agents can be activated on the following sources:

To activate AI agents:

  1. Go to Agentic Fabric.

  2. From the navigation menu, go to the Non-Human Identities section and select Agents.

  3. Find the agent that you want to activate and select Actions > Activate Agent.

  4. If your request requires approval, enter the business justification for activating this agent in the Comment field and select Request.

  5. If your request does not require approval, select Activate. The AI agent becomes active on the source.

    If you submitted a request, you can track its status on the Agent Requests page in your Request Center. You'll also receive email notifications about the request throughout its approval and provisioning process.

    If your request is approved, the agent is activated on the source. If your request is denied, no action is taken on the agent.

Blocking AI Agents

If you find that someone in your network is using a suspicious or prohibited endpoint agent, you can block their access to the agent. An endpoint agent is an AI agent running on endpoints such as employee Windows and Mac devices, discovered through endpoint sensors and plugins.

You can block agents discovered through SailPoint Endpoint Agent Security that support enforcement.

To block an agent:

  1. Go to Agentic Fabric.

  2. From the navigation menu, go to the Non-Human Identities section and select Agents.

  3. Search for or find the endpoint agent that you want to block and select Actions > Block Agent.

    Notes

    • Only endpoint agents can be blocked through this action.
    • Blocking applies to the selected agent for all users on the selected endpoint.
    • Blocking does not uninstall the agent or delete its files.

  4. In the confirmation window, select Block.

    Important

    Blocking an agent might result in the disruption of data or processes.

SailPoint Endpoint Agent Security will attempt to block the agent the next time the user's device is online. If successful, the user will receive a system notification alerting them that the agent has been blocked based on their organization's policy.

Unblocking AI Agents

If a blocked endpoint agent is determined not to be a risk, you can unblock the agent and allow access.

  1. Go to Agentic Fabric.

  2. From the navigation menu, go to the Non-Human Identities section and select Agents.

  3. Search for or find the endpoint agent that you want to unblock and select Actions > Unblock Agent.

  4. In the confirmation window, select Unblock.

Deactivating AI Agents

You might need to deactivate a suspicious AI agent to contain a potential security threat. You can deactivate agents on the following sources:

To deactivate AI agents:

  1. Go to Agentic Fabric.

  2. From the navigation menu, go to the Non-Human Identities section and select Agents.

  3. Find the agent that you want to deactivate and select Actions > Deactivate Agent.

  4. If your request requires approval, enter the business justification for deactivating this agent in the Comment field and select Request.

  5. If your request does not require approval, select Deactivate. The agent is deactivated on the source.

    If you submitted a request, you can track its status on the Agent Requests page in your Request Center. You'll also receive email notifications about the request throughout its approval and provisioning process.

    If your request is approved, the agent is deactivated on the source. If your request is denied, no action is taken on the agent.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.