Asset Access
Allow, warn, or block an AI asset. What each action does on the endpoint, and how to apply one to one asset, many assets at once, or one asset on one endpoint.
console.superalign.ai/remediation
Every AI asset starts Ungoverned: found, scored, but nobody has taken action on it yet. It waits in the Open tab on the Asset Access page. When an Admin applies Allow, Warn, or Block, the asset becomes Governed.
The three actions
| Action | What happens on the endpoint | When to use it |
|---|---|---|
| Allow | Nothing changes. The asset is recorded as approved | Assets you are fine with |
| Warn | The person sees a system notification that the asset is not approved, and sees it again each time the asset opens. The asset stays installed | Assets under review, or tolerated with a reminder |
| Block | The scanner backs the asset up, then removes it. If it cannot be removed, the scanner closes it every time it opens | Assets that are not permitted |
An action is company-wide by default. You can also make an exception for one endpoint, for example a security researcher who needs a blocked asset. See One asset on one endpoint.
How an action reaches endpoints
Endpoints that are online act within seconds. Endpoints that are offline act at their next scan. Every endpoint reports back, and failures show in the Audit Log.
Before you begin
You have the Admin role. Auditors can see the page but not take action.
The Asset Access page
Open Policies › Asset Access in the left menu. The page has four tabs, each with a live count.
| Tab | Contents | Shortcut |
|---|---|---|
| Open | Assets seen recently with no action yet | C then O |
| Allowed | Assets you allowed | C then A |
| Warned | Assets you set to warn | C then W |
| Blocked | Assets you blocked | C then B |
Columns are Risk, Asset Name, Asset Type, and Instances (how many endpoints have it). Filter by type, risk level, and number of endpoints.
Actions never quietly disappear. An asset stays in Allowed, Warned, or Blocked even if no endpoint has reported it recently.
One asset
Open the asset
Click its name. A panel opens on the right.
Take action
At the bottom of the panel, click Take Action, or press A.
Choose a scope
Global applies to every endpoint that has the asset. By Instance lets you pick endpoints by hostname.
Choose the action
Click Allow, Warn, or Block, or press A, W, or B. With Global, the one already in force is greyed out. Cancel (C) backs out without changing anything.
Confirm
Read the window. It names the asset. With Global it says the action applies to all affected endpoints. With By Instance it gives the number of endpoints when you picked more than one. Click the matching button.
The asset moves to its tab, shows Governed in Inventory, and an audit entry is written.
Many assets at once
Specific assets. Tick the box next to each one, or click a row and drag down to select a range. The panel becomes Selected Assets with the same three buttons plus Clear Selection (C). The button matching the current tab is disabled, since it would change nothing. The confirmation window names the number of assets, such as “12 assets”, not each asset.
Everything matching a filter. Tick the box in the table header. The action applies to every asset that matches the current search and filters, up to 500 per batch, highest risk first. If more match, the console tells you how many remain for the next batch.
Each batch is all-or-nothing. If you change tabs, filters, search, or sort with two or more assets selected, the console asks before discarding the selection.
One asset on one endpoint
Use By Instance in the steps above, or start from the endpoint:
Open the endpoint
Go to Endpoints and click the endpoint.
Open the asset on it
On the Assets tab, click the asset.
Choose
Use Allow, Warn, or Block in the panel. This applies to this endpoint only.
For a Governed asset with no exception on this endpoint, the panel shows Inherits Default under Current Enforcement: the endpoint follows the company-wide action. For an Ungoverned asset, the panel shows Recommended Action instead.
Checking what was applied
Every action, single or batch, is in the Audit Log under Asset Governance, with who applied it, when, and the before and after state of each asset.
Next steps
- Audit Log to see what was applied and when
- Endpoints to check an endpoint after a Block
- How risk is calculated to choose with the score in mind