---
title: Asset Access
description: Allow, warn, or block an AI asset. What each action does on the endpoint, and how to apply one to one asset, many assets at once, or one asset on one endpoint.
---

_[console.superalign.ai/remediation](https://console.superalign.ai/remediation)_

Every AI asset starts **Ungoverned**: found, scored, but nobody has taken action on it yet. It waits in the **Open** tab on the Asset Access page. When an Admin applies Allow, Warn, or Block, the asset becomes **Governed**.

```mermaid
flowchart LR
  N[Scanner finds an asset] --> O[Open tab]
  O -->|Allow| A[Allowed]
  O -->|Warn| W[Warned]
  O -->|Block| B[Blocked]
```

## The three actions

| Action | What happens on the endpoint | When to use it |
| --- | --- | --- |
| **Allow** | Nothing changes. The asset is recorded as approved | Assets you are fine with |
| **Warn** | The person sees a system notification that the asset is not approved, and sees it again each time the asset opens. The asset stays installed | Assets under review, or tolerated with a reminder |
| **Block** | The scanner backs the asset up, then removes it. If it cannot be removed, the scanner closes it every time it opens | Assets that are not permitted |

An action is company-wide by default. You can also make an exception for one endpoint, for example a security researcher who needs a blocked asset. See [One asset on one endpoint](#one-asset-on-one-endpoint).

## How an action reaches endpoints

```mermaid
sequenceDiagram
  participant Admin
  participant Console
  participant Endpoint
  Admin->>Console: Block "Asset X"
  Console-->>Endpoint: Notified within seconds (if online)
  Endpoint->>Endpoint: Back up, then remove Asset X
  Endpoint-->>Console: Report: removed or failed
  Console-->>Admin: Audit Log entry
```

Endpoints that are online act within seconds. Endpoints that are offline act at their next scan. Every endpoint reports back, and failures show in the [Audit Log](/surface/activity/audit-log).

:::warning
Block removes software from people's endpoints. Read the confirmation window. With **Global** it says "all affected endpoints" and gives no number. For a new asset, try Warn on a small group first.
:::

## Before you begin

You have the **Admin** role. Auditors can see the page but not take action.

## The Asset Access page

Open **Policies › Asset Access** in the left menu. The page has four tabs, each with a live count.

| Tab | Contents | Shortcut |
| --- | --- | --- |
| **Open** | Assets seen recently with no action yet | `C` then `O` |
| **Allowed** | Assets you allowed | `C` then `A` |
| **Warned** | Assets you set to warn | `C` then `W` |
| **Blocked** | Assets you blocked | `C` then `B` |

Columns are **Risk**, **Asset Name**, **Asset Type**, and **Instances** (how many endpoints have it). Filter by type, risk level, and number of endpoints.

Actions never quietly disappear. An asset stays in Allowed, Warned, or Blocked even if no endpoint has reported it recently.

## One asset

1. **Open the asset**

    Click its name. A panel opens on the right.

2. **Take action**

    At the bottom of the panel, click **Take Action**, or press `A`.

3. **Choose a scope**

    **Global** applies to every endpoint that has the asset. **By Instance** lets you pick endpoints by hostname.

4. **Choose the action**

    Click **Allow**, **Warn**, or **Block**, or press `A`, `W`, or `B`. With Global, the one already in force is greyed out. **Cancel** (`C`) backs out without changing anything.

5. **Confirm**

    Read the window. It names the asset. With **Global** it says the action applies to all affected endpoints. With **By Instance** it gives the number of endpoints when you picked more than one. Click the matching button.

The asset moves to its tab, shows **Governed** in Inventory, and an audit entry is written.

## Many assets at once

**Specific assets.** Tick the box next to each one, or click a row and drag down to select a range. The panel becomes **Selected Assets** with the same three buttons plus **Clear Selection** (`C`). The button matching the current tab is disabled, since it would change nothing. The confirmation window names the number of assets, such as "12 assets", not each asset.

**Everything matching a filter.** Tick the box in the table header. The action applies to every asset that matches the current search and filters, up to 500 per batch, highest risk first. If more match, the console tells you how many remain for the next batch.

Each batch is all-or-nothing. If you change tabs, filters, search, or sort with two or more assets selected, the console asks before discarding the selection.

## One asset on one endpoint

Use **By Instance** in the steps above, or start from the endpoint:

1. **Open the endpoint**

    Go to **Endpoints** and click the endpoint.

2. **Open the asset on it**

    On the **Assets** tab, click the asset.

3. **Choose**

    Use **Allow**, **Warn**, or **Block** in the panel. This applies to this endpoint only.

For a **Governed** asset with no exception on this endpoint, the panel shows **Inherits Default** under **Current Enforcement**: the endpoint follows the company-wide action. For an **Ungoverned** asset, the panel shows **Recommended Action** instead.

## Checking what was applied

Every action, single or batch, is in the [Audit Log](/surface/activity/audit-log) under **Asset Governance**, with who applied it, when, and the before and after state of each asset.

## Next steps

- [Audit Log](/surface/activity/audit-log) to see what was applied and when
- [Endpoints](/surface/environment/endpoints) to check an endpoint after a Block
- [How risk is calculated](/surface/overview/risk-scoring) to choose with the score in mind