Review agent security posture
Use Agents in Protect to find agents that need attention and investigate the risks behind their scores. Open an agent to review its current configuration findings, runtime issues, and the tools, skills, and subagents it uses.
Prerequisites
Complete the following prerequisites:
- Confirm that agent posture is enabled for your environment. If Security posture doesn't appear in Protect, contact your Glean account team.
- Have the Super Admin or Sensitive Content Moderator role. See Administrator Roles.
- To review every listed agent, have permission to view all agents, such as the Super Admin or Agent Moderator role. Otherwise, the inventory includes only the agents you can access.
Find an agent
To review an agent:
- Open Protect from the Glean navigation.
- Under Security posture, click Agents.
- Use Search agents or the filters to narrow the inventory, then click an agent's name.
The inventory shows each agent's Risk, Open issues, Creator, and Shared with information. Risk shows the agent's score, colored by risk level, or Unassessed. Hover over or click an agent's Shared with value to see who it's shared with, without opening the agent details. Everyone means that the agent is shared with your whole workspace.
Use these controls to narrow the list:
| Control | What it matches |
|---|---|
| Search agents | Text in an agent's name or description |
| Agent creator | Agents created by the selected people |
| Open issues | Agents with or without open runtime issues |
| Risk | One or more assessed risk levels: Critical, High, Medium, or Low |
| Rules | Agents associated with selected runtime policies or static scan rules, not only agents with failed findings |
The inventory includes listed agents you can view, including agents that have never been published. Unlisted agents don't appear. Because Overview leaves out agents that have never been published, its totals can differ from the inventory.
The summary cards show totals across your accessible inventory. Filtering changes the table results, not the population counted by those cards. Agents without an assessment contribute to Total agents but not to a scored risk category.
Interpret an agent's score
The Risk summary shows the agent's score out of 100 and its assessment status. The score combines findings from the agent's configuration, its resources, and open runtime issues. Resources include the tools, skills, and subagents the agent uses.
Use these score ranges to prioritize review:
| Risk level | Score |
|---|---|
| Low | 0–24 |
| Medium | 25–49 |
| High | 50–74 |
| Critical | 75–100 |
A low-risk configuration scan doesn't guarantee a low overall score. Open runtime issues can raise the agent's rating.
Check the assessment status before comparing scores. An agent without either of these labels is fully assessed:
- Unassessed means that the current agent definition has no completed scan. Glean doesn't assign it a score, even if runtime issues exist.
- Partially assessed means that the agent has a score but some assessment signals are missing. The score can increase as those signals become available.
Inspect tools, skills, and subagents
In Risk summary, click Tools, Skills, or Sub agents to open a read-only list of that component type. Each list shows components in descending risk order, followed by components that haven't been scanned. Where available, each component includes a risk level and an explanation from its scan.
The risk indicator for a component type reflects its highest-risk assessed component, not an average across the list. Interpret the other states as follows:
- None means that the agent has no components of that type, and there's no list to open
- Not scanned means that the components don't have scan-derived risk information yet, not that their risk is low
The Agent details section also shows the creator, sharing preview, Last scanned timestamp, and tool counts. Read, write, and automatic-execution counts depend on the current scan. If that breakdown isn't available, the page can show the configured tool count instead.
Click View spec to open the agent definition. The component lists themselves don't change the agent or its tools.
Review runtime issues
Open the Runtime issues tab to review daily issue counts by severity for the past 10 days. The Open issues section shows the latest open issues with their guardrail names, enforcement actions when present, and timestamps.
The list shows only the latest issues when the agent has more open issues than the page displays. The Open issues count includes issues that are open or in progress.
Click an issue to open its details pane, the same pane that AI security issues uses. Triage the issue there, or move to the next or previous issue in the list. When you close the pane, the list refreshes. See Findings Dashboard.
Review configuration risks
Open the Configuration risks tab to see the failed and passed scan rules for the agent's current definition.
If that definition hasn't been scanned, the page says so instead of showing findings from an older version. After an agent changes, don't use an earlier scan as evidence that the current definition has passed review.
Review the findings alongside the agent definition to decide what needs to change. This tab displays scan results. It doesn't start a new scan or apply fixes.
See also
- Review overall risk posture — compare risk across agents and Glean Assistant and review recommended remediations
- Review Glean Assistant security posture — review the Glean Assistant risk score, issues, and enabled tools
- Configuring Policies — manage runtime guardrails for agents