The AI Control Center gives administrators one place to find and fix Egnyte agents that interact with content in a less secure manner. It lists the agents in the domain, flags agents with a scope that is too broad or that can reach sensitive content, and recommends an action for each one.
- This feature is available to customers on the Ultimate plan. Contact the account manager or Egnyte Sales team for more information.
- Sensitive content detection requires Content Classification policies to be configured.
Benefits
- See which agents need attention: Review every agent with an open issue in one list, instead of opening each agent's settings.
- Find agents that reach sensitive content: Agents are matched against the Content Classification policies that apply to the folders they use.
- Prioritize by risk: Each flagged agent has a High, Medium, or Low risk level and a reason for the flag.
- Fix issues in the same place: Re-scope an agent, create an AI Safeguard policy, or change tool permissions directly from the AI Control Center.
- Support AI adoption: Give users access to agents while keeping visibility into what those agents can reach and do.
Common Use Cases
- Unrestricted agent review: Find agents set to use all Egnyte files and folders, and re-scope them to specific folders.
- Sensitive content exposure: Find agents scoped to folders that contain classified content, and either re-scope them or create an AI Safeguard policy.
- Unsupervised actions: Find agents with Egnyte tools or third-party connector tools set to Always allow and change them to Ask each time.
- Post-rollout check: Review newly created agents
Access the AI Control Center
- Navigate to Settings → AI Powered Features → AI Control Center
-
Review the list of agents. By default, the list shows all agents with open issues. The following columns are available:
- Agent: The agent name. Use the search box to find a specific agent.
- Risk: The agent's risk level, High, Medium, or Low. Use the filter to view specific levels.
- Reason: The main reason the agent was flagged. If more than one reason applies, the number of additional reasons is shown. For example, Unrestricted access +1. Use the filter to view specific reasons. For agents with multiple reasons, the reasons can be viewed by clicking the "+1" or viewing the full agent details.
- Created by: The user who created the agent. Use the filter to view agents created by specific users.
Each row also has a three-dot menu with the available actions.
How Risk Levels Are Determined
An agent's risk level comes from two types of configurations:
- Egnyte folder source: The content the agent can reach.
- Connectors: The actions the agent can take, using Egnyte tools or third-party connector tools.
The AI Control Center evaluates the agent's configured scope, not what a specific user can reach when running the agent. Risk levels are shown as High, Medium, or Low. If an agent matches more than one rule, it appears once in the list with a combined risk level, and every reason is shown.
| Rule | When it applies | Risk level on its own | Combined with other rules |
| Unrestricted access | The agent's source is set to all Egnyte files and folders. The agent reaches everything the user who runs it can access. | High | Stays High. |
| Reaches sensitive content | The agent's source is set to selected files and folders that contain content tagged by Content Classification policies. | Based on the sensitivity of the folders: Low, Medium, or High. | Raised by the two connector rules below. |
| Unsupervised Egnyte action | An Egnyte tool that changes content is set to Always allow. These tools copy, move, rename, or create files and folders, and update file metadata. | Medium | With Reaches sensitive content, raises the risk level by one step: Low to Medium, or Medium to High. |
| Unsupervised connector tool | A third-party connector tool, such as Gmail, Salesforce, or Procore, is set to Always allow. | Low | With Reaches sensitive content, raises Low to Medium only. It does not raise Medium to High. |
- If both connector rules apply to the same agent, the Egnyte action rule sets the increase, and both reasons are shown.
- At this time, Egnyte cannot tell whether a third-party connector tool reads or changes content. Any third-party tool set to Always allow is flagged, including tools that only read content.
- Agents that do not match any rule are not shown.
Review Agent Details
Select an agent in the list to open its details panel. The panel shows the following:
- Risk level and agent name: The risk level badge and name appear at the top, with the available actions.
- Issues: A description of each reason the agent was flagged. For example; Agent reaches content that matches 4 content classification policies or Agent can copy, move, or update Egnyte content without asking first.
- General: Who created the agent and when.
- What can Agent Reach: The agent's Egnyte sources (for example; 2 folders), whether web sources are enabled, and the sensitive content tags that apply to its sources. Click View to see the sources.
- Connectors & Tools: Each connector and tool the agent uses, and whether the tool is set to Always allow or Ask each time.
Resolve Flagged Agents
Each flagged agent has recommended actions. Actions are available from the three-dot menu on each row and from the details panel.
| Action | Unrestricted access | Reaches sensitive content | Unsupervised Egnyte action | Unsupervised connector tool |
| Rescope | Yes | Yes | No | No |
| Create AI Safeguard policy | No | Yes | No | No |
| Set tool to always ask | No | No | Yes | Yes |
Rescope an Agent
Use this action to limit the agent to specific folders.
- Select the agent and click Rescope.
- The Edit Agent window opens on the Sources tab. Review the agent's current sources. Use the All, Egnyte, and Web filters to narrow the list. Remove sources the agent should no longer use or click Add sources to select specific folders.
- Click Save in the top right of the window.
Create an AI Safeguard Policy
Use this action to block AI from processing the sensitive content an agent reaches. This action is available only for agents flagged with Reaches sensitive content.
- Select the agent and click Create AI Safeguard policy.
-
The New AI Safeguard policy window opens with the matching Content Classification policies already selected.
- Enter a Name for the policy.
- Review the Criteria. To add more criteria, click Add criteria.
- Review the Summary, which describes the content that AI processing will be restricted for.
- Click Create.
After the policy is created from the AI Control Center, the Reaches sensitive content reason is marked as resolved for the agent.
AI Safeguards do not apply to connector tool calls. A policy resolves only the Reaches sensitive content reason. To resolve the other reasons, change the tool permissions.
Set Tool Permissions to Always Ask
Use this action to require approval before an agent runs a tool. This action is available for agents flagged with Unsupervised Egnyte action or Unsupervised connector tool.
- Click the three-dot menu on the agent's row, or the three-dot menu in the details panel and select Set tool to always ask. The Update tool permissions window opens.
- Review the agent's recommended tools. By default, tools are set to Ask each time. To apply one setting to all tools in a group, use the All tools menu. To change a single tool, select Always allow, Ask each time, or Never allow for that tool. Click Save.
Changes apply only to the selected agent. Other agents and domain-level connector settings are not changed. For more information on tool permissions, see AI Connectors - Admin Guide.