Frequently Asked Questions
Activity & Events
Why is the Activity feed empty?
The feed only shows events when an agent makes a tool call through Behavry. If no agent has connected or made a call yet, the feed will be empty.
Check that your agent is enrolled and that it has made at least one call. See Enroll an Agent →
Why am I not seeing events from a specific agent?
- Go to Agents and confirm the agent's status is Active (not Suspended or Revoked)
- In the Activity feed, clear any active filters — you may be filtered to a different agent or time window
- Confirm the agent has made calls recently — the default view shows the last 24 hours
What does each policy decision mean?
| Decision | What happened |
|---|---|
| allow | The tool call passed all checks and was forwarded to the target |
| deny | The tool call was blocked by a policy rule |
| escalate | The call is on hold — waiting for a human decision in Escalations |
| restrict | The agent is in restricted mode — only permitted actions are allowed |
Agents
How do I suspend an agent immediately?
Go to Agents → [agent name] → Suspend. All active sessions are revoked instantly. The agent cannot make any further calls until reactivated.
What is an agent's risk tier?
Risk tier reflects how anomalous the agent's recent behavior is compared to its baseline. It updates continuously.
| Tier | Meaning |
|---|---|
| Low | Normal, predictable behavior |
| Medium | Minor deviation — monitor |
| High | Significant deviation — investigate |
| Critical | Extreme deviation — act immediately |
See Operational Runbooks → for what to do at each tier.
What is a behavioral baseline?
Behavry builds a statistical model of each agent's normal behavior — which tools it calls, how frequently, in what patterns. Deviations from baseline trigger anomaly alerts. Baselines improve in accuracy over the first few days of an agent's operation.
Policies
My policy is not blocking anything — why?
- Confirm the policy status is Active (not Draft) — only active policies are evaluated
- Use the Test button on the policy to verify it matches the input you expect
- Check that the Rego syntax is correct — a policy with a syntax error will be skipped silently
What is the difference between deny and escalate?
- deny — blocks the call immediately, no human involved
- escalate — holds the call and alerts your team; a human approves or denies before the agent can continue
When both deny and escalate match the same call, deny takes precedence.
What happens if no policy matches a tool call?
Behavry is default-deny. If no active policy explicitly allows a tool call, it is blocked. Nothing passes through silently.
Escalations
What is HITL escalation?
HITL (Human-in-the-Loop) escalation means an agent's tool call is on hold and requires a human decision before it can proceed. Go to Escalations in the dashboard to see the pending queue and approve or deny each request.
Escalations time out automatically if not reviewed — the default timeout varies by the agent's risk tier (see Runbooks →).
Can I prevent the same action from escalating again?
Yes — when you approve an escalation, check Create Exception. That exact combination of agent, action, and resource will be allowed directly in future without requiring review.
Alerts
An alert fired — what should I do?
Go to Alerts, read the alert description, and follow the runbook for the alert type. See Operational Runbooks → for step-by-step guidance on every alert category.
Alerts are informational — they don't block agents. You decide whether to investigate, acknowledge, or escalate to a suspension.
What is a DLP alert?
A DLP (Data Loss Prevention) alert means Behavry detected sensitive content — PII, credentials, financial data, healthcare records, etc. — in an agent's input or output. DLP alerts are always Critical severity.
Go to Alerts, open the event detail to see what was detected and in which tool call.
Coverage
Does Behavry monitor the ChatGPT Desktop App?
No. The ChatGPT Desktop App uses TLS certificate pinning, which prevents interception.
What you can monitor:
- ChatGPT web app (chatgpt.com) — via the browser extension
- ChatGPT API usage — via the OpenAI API proxy (see guide)
Does the browser extension work in all browsers?
The extension is currently available for Chrome and Chromium-based browsers (Edge, Brave, Arc). It monitors 12 AI services including ChatGPT, Claude, Gemini, Perplexity, Copilot, and more.
Security
Can an agent forge its identity?
No. Each agent authenticates with a JWT signed by Behavry's private key. Agents never possess the private key — they receive only a credential that Behavry uses to issue tokens server-side. The token cannot be modified or forged.
What happens when I revoke an agent?
The agent's status is set to Revoked immediately. All new requests return an authentication error. Any call already in-flight that holds a valid token will complete, then fail on the next request.
For immediate termination of all sessions, use Suspend instead of revoke — suspension is instant and session-level.