GenGuard portal exception approvals

From Agent One 4.0.3596 (retry window hardened in 4.0.3600+) and GenGuard extension 3.4.8+, a blocked transfer can offer an optional exception request. The transfer stays blocked until the user chooses Request exception. After admin approval, the station shows approved and the user retries.

Requires:

• Agent One 4.0.3600+ recommended (Session-readable grant delivery + retry window after once-grants)
• GenGuard extension 3.4.8+ for the same opt-in button in the browser (Agent One enrolled for native host)
• GenGuard entitled; Security Policies → GenGuard → Files with Portal exception approval enabled
• Operators with policy write access for the GenGuard Exceptions queue

Desktop scope: drag-and-drop retry

On Agent One (endpoint GenGuard), portal exception approval and local unlock bypass are supported for Explorer drag-and-drop (and file clipboard paste) into covered apps.

Attach / paperclip / Open-file dialogs stay hermetic blocks. After an approval, tell users to drag the same file again from Explorer onto the covered app - do not rely on Attach as the exception retry path.

Block vs Block with bypass vs portal exception

These are separate controls. Hermetic enforcement (no silent allow while OCR is still running; cancel Enter / double-click on Attach) applies to both Block and Block with bypass. Only Warn leaves the transfer open after a match.

Justified blocks do not open an Exceptions row automatically.

What the user sees (Agent One)

1. GenGuard blocks a covered drag/clipboard file action and shows the top bar (Request exception / Dismiss). The offer bar closes after about 10 seconds if unused.
2. Request exception → bar switches to waiting; a pending row appears under GenGuard → Exceptions.
3. Admin Approve → station receives the grant (usually within about one minute). The same bar switches to approved for about 10 seconds.
4. User retries with drag-and-drop of the same file within the short retry window (~90 seconds after the grant lands).
5. Once grants allow the matching retry, then end. TTL grants allow matching transfers until the window expires.

Configure policy

In Security Policies → GenGuard → Files:

1. Set the Files action to Block or Block with bypass.
2. Optionally enable Portal exception approval.
3. Choose Grant mode:
   • Once (N transfers) - after approval, up to N matching retries are allowed.
   • Time window - matching transfers are allowed until the TTL (minutes) expires.
4. Optionally list Department approvers as Department|email lines.

Save the policy and Sync / Pull now on pilot stations. Reload the GenGuard extension after policy sync.

Operate the queue

Open GenGuard → Exceptions (sidebar under GenGuard).

Audit actions include GENGUARD_EXCEPTION_REQUESTED, APPROVED, DENIED, and DELEGATED.

Validate

1. Enable portal exception approval; set mode to Once with 1 use.
2. On Windows Agent One 4.0.3600+, drag a matching file onto a covered app (for example ChatGPT Desktop).
3. Confirm the top bar appears without a new Exceptions row until Request exception.
4. Confirm a pending row after the request; Approve in the portal.
5. Confirm the station bar shows approved, then drag the same file again within ~90 seconds - transfer should succeed.
6. Drag again after the window - expect a new block (once grant consumed).
7. Optional: confirm Attach/paperclip still blocks hermetically and is not the documented retry path.

Related

• GenGuard endpoint DLP (TAO)
• GenGuard Live Events and Browser Agents
• How TAO agent sync and updates work
• Shadow AI and Warn