Agent scan

Glean Protect+

Use Agent scan to assess risks in agent definitions, such as excessive data access or write tools that do not match the stated purpose. Scan policies define the checks and identify agents that need approval before publication.

Agent scan checks configuration. For controls that evaluate activity during an agent run, see Agent security.

What agent scans check

Glean provides system rules that assess common configuration risks. The rules can check whether:

• The agent description matches the behavior in its instructions
• The agent has write tools that do not support its stated purpose
• The agent instructions and tool descriptions give enough guidance for write tools
• The agent can access more data than its task needs
• The agent can run write tools without user approval

Agent scan uses the risk levels Critical, High, Medium, Low, and Safe. Open a finding to review its reasoning, supporting evidence, and suggested fix.

Glean defines the system rules. You can change the approval setting for a system rule, but you cannot edit its definition. Create a custom rule when your organization needs a different check.

Prerequisites

Confirm that your organization has Agent scan enabled. The Agent scan policy and Agent scan tabs appear only when your organization has the corresponding feature enabled.

Create an agent scan policy

An agent scan policy groups rules and sets which agent creators the policy covers.

1. In the Admin console, go to Protect.
2. Under AI security, select Policies → Agent scan policy, then select Create policy.
3. Enter a policy name and description.
4. Under Agents created by, choose all teammates or select specific users or groups.
5. Under Policy rules, select Add rule, then select Create custom rule.
6. Choose Prompt based to describe the risk in instructions, or choose CEL to evaluate agent configuration fields with Common Expression Language (CEL).
7. Set the rule Title, Description, and Assigned risk. Select Requires approval to require an Agent Moderator to approve matching agents before publication.
8. Select Publish to save the policy. Keep the policy enabled to include its rules in scans.

For CEL rules, select Show parameters in the rule editor to view the fields you can evaluate. Glean checks CEL syntax when you save a rule.

Review agent scans

In the Admin console, go to Protect, then select AI security issues → Agent scan. The Agent scan view summarizes scanned agents by risk level and total count. Search for an agent, then filter by Risk, Requested by, or Policies triggered. Select a row to open its details.

The details include:

• Findings: Each policy and rule result, its severity, reasoning, evidence, and suggested fix
• Scan history: Agent versions, scan results, and publication approval status
• Agent details: The agent description, tools, data access, and sharing audience

When a rule requires approval, the scan history shows the approval status and the Agent Moderator who approved or rejected the publication.