Allow, Warn, Block
The three decisions you can make about an AI tool, what each one does on the laptop, and how a tool moves between them.
Every AI tool starts Ungoverned: found, scored, but nobody has decided about it yet. It waits in the Open list on the Remediation page. When an Owner or Admin decides, the tool becomes Governed.
The three decisions
| Decision | What happens on the laptop | When to use it |
|---|---|---|
| Allow | Nothing changes. The tool is recorded as approved | Tools you are fine with |
| Warn | The person sees a system notification that the tool is not approved, and sees it again each time the tool opens. The tool stays installed | Tools under review, or tolerated with a reminder |
| Block | The scanner backs the tool up, then removes it. If it cannot be removed, the scanner closes it every time it opens | Tools that are not permitted |
How a decision reaches laptops
Laptops that are online act within seconds. Laptops that are offline act at their next scan. Every laptop reports back, and failures show in the Audit log.
Scope
A decision is company-wide by default. You can also make an exception for one laptop, for example a security researcher who needs a blocked tool. See Remediate a tool.
Decisions never quietly disappear. A tool stays in Allowed, Warned, or Blocked even if no laptop has reported it recently.