Response actions
Revoke access today; throttle and pause are planned.
Revoke is generally available. Throttle and pause are roadmap.
When an anomaly points at an agent you no longer trust, marking the anomaly isn't enough: the agent still has access. Revoke access cuts the agent off from the gateway until someone signs it in again.
Revoke an agent
On Agents & NHIs, open a row's actions menu and select Revoke access. It clears all active tokens and consents for the agent, and the user can grant access again later. The gateway records the revocation time and rejects any token issued before it, so the agent must authenticate again. Revoke access appears only for an agent with an OAuth client that isn't already revoked, and only where your deployment supports it. A custom agent with a static API key has no token to revoke, so you delete its instance instead. Each revocation is recorded in the audit log.
Triage the anomaly
After you act, set the anomaly's status on Anomalies. Acknowledge marks it as tracked, Dismiss marks it as needing no action, and Reopen returns it to open.
For every way to revoke access, see Revoking access.