Security Policies hub
Navigate entitled policy areas, edit profiles bound to tags, and apply seat-gated modules to the right stations.
Security Policies hub
Overview → Security Policies is the central policy workspace. Each visible tab identifies What this policy enforces and Applied by so operators can connect a setting to its enforcement component.
GenGuard, FileGuard, and VisionX also show how they depend on each other:
- GenGuard asks FileGuard which files are classified before a browser upload. Local AI Runtime uses those same labels against desktop AI tools.
- FileGuard is the label. GenGuard and Local AI Runtime ask it; they do not keep a second file list.
- VisionX watches someone photographing the screen. GenGuard and FileGuard stop data leaving the workstation.
Access and entitlement
The page appears when the organization has at least one enabled module. Tabs are entitlement-driven:
- TAO Agent - Windows endpoint hardening (organization-wide).
- GenGuard - keyword blocking, named patterns (including Medical / PHI), domain allow/block lists, browsing categories, Warn/Block actions, Shadow AI discovery, and Agent One endpoint GenGuard.
- FileGuard - file labels, on-station discovery, browser enforcement, Local AI Runtime disk stops for desktop AI (Agent One 5.0.12+), and the Windows right-click menu (Agent One 4.0.3579+). Full ransomware Block* is scheduled for the first quarter of 2027.
- VisionX - visual-channel risk (phones, cameras, lenses), lock-on-detection, evidence capture, unlock code, and activation.
- Vault / PAM / IPS - password rotation, Personal Vault limits, HostGuard IPS, and publishing the employee File Vault.
- ZeroDevice - USB/BT peripheral learning, approve/reject, and challenge controls.
The TAO Agent tab may appear with several endpoint-related entitlements, not only a separately named TAO entitlement. Vault users have a sidebar limited to Secure Vault. Other role labels indicate intended responsibility; follow your organization’s change-approval policy even when controls are visible.
Tags, profiles, and seats (module targeting)
Module policy for VisionX, GenGuard (Agent One), FileGuard, ZeroDevice, and HostGuard IPS is targeted with tags, Policy Bundles, and profiles on stations, not with “apply this policy to a device group,” and not by Active Directory user.
Seats answer “how many PCs may run this module.” Tags answer “which PCs for one module.” Policy Bundles answer “which multi-module profile set.” Whoever signs in on a tagged or bundled PC gets those modules there. FileGuard’s “who may open” list remains user/group-based on top of that. GenGuard browser extension licensing stays organization-wide and is separate from station tags. Full detail: Tags, profiles, seats, and Policy Bundles.
- Your commercial package includes per-module seats (set with your Trustity account team).
- Under Profiles & tags on each module tab, select the profile you are editing, optionally create named profiles, and bind each profile to a tag (or include profiles in a Policy Bundle).
- On Devices & Tags (or Managed devices), assign stations—or a whole folder—to those tags or to a Policy Bundle (up to the seat cap per module).
- Edit and save the form for the selected profile.
| Scope | Effect |
|---|---|
| Default profile | Organization baseline tables plus synced Default profile config |
| Named profile | Config stored on that profile only; applies to stations on its bound tag |
| Seats set to N | Only tagged stations receive that module |
| Seats unset | Legacy org-wide entitlement with Default (avoid for new deals) |
Always organization-wide (not seat-tagged): TAO Agent hardening, PAM rotation interval, and Vault file/share limits. HostGuard IPS settings participate in profiles/tags; PAM and Vault file rules on the Vault tab stay on Default / org save.
Full operator guide: Tags, profiles, seats, and Policy Bundles.
Device folders on Managed devices are for organization and selection only. They do not merge policy overrides into the agent document.
Manual groups or Active Directory (device tree)
Above the tabs, Directory inventory still chooses how the Managed devices tree is sourced (portal folders vs Active Directory). That switch is for inventory and browsing. Module policy overlays use tags, not those folders. AD connection and multi-station readers are configured under Devices & Tags. See Follow Active Directory for devices and policy.
Controlled policy workflow
- Obtain approval and record the current policy state.
- Confirm seat counts for the modules in scope with your Trustity account team.
- Open Security Policies.
- Select the entitled policy tab and the profile under Profiles & tags.
- Confirm the profile is bound to the intended tag; tag stations under Managed devices.
- Read What this policy enforces and Applied by.
- Change only the approved fields. Avoid combining unrelated policy changes.
- Use the panel’s exact save control and wait for its success message.
- Refresh the page and confirm the saved values remain selected.
- Allow the enforcing agent or extension to refresh (Pull now on Agent One 4.0.3587+ to confirm tags on Overview).
- Validate on a tagged pilot endpoint and in the related event or device view.
- Review Audit Logs for the policy update when the workflow emits an audit record.
Tab-specific validation
TAO Agent
Use Save endpoint hardening. The success message states that agents refresh on the next heartbeat. Validate the device’s policy version and expected local behavior. See TAO endpoint hardening.
GenGuard
After saving, validate an approved allowed case and an approved blocked case. Use Browser Protection → Live Events to confirm reporting. Named GenGuard profiles apply to tagged stations via TAO; the browser extension remains organization-scoped. Do not test with production-sensitive data.
FileGuard
Enable the module, then review What stations found. Classify a pilot file and confirm the browser holds it. A masked excerpt is optional and expires after 15 minutes. * Ransomware protection is scheduled for the first quarter of 2027.
See FileGuard overview.
VisionX
Validate the selected activation and enforcement behavior on a controlled tagged endpoint. In Managed devices, review VisionX health and Details, including camera, model, session, activation, and unlock-code readiness.
Vault / PAM / IPS
Default scope saves IPS, PAM rotation, and Vault file/share rules together. A named HostGuard profile edits IPS only - PAM and Vault file rules stay on Default. Validate only on a designated test asset. After publishing Organization File Vault, confirm the employee login at /org-vault/login and that a TCP account cannot use it.
See Organization File Vault for employees.
ZeroDevice
Save learning/enforcing mode and class defaults for the selected profile. Use ZeroDevice → Stations for per-host exceptions when a single endpoint needs different rules on top of the tagged profile.
Troubleshooting
No policy modules enabled
Confirm you are in the correct organization and that the expected subscription modules are enabled. Select Open Deployment Center only after entitlement is confirmed.
An expected tab is missing
Check module entitlement and the user’s role. Missing tabs generally indicate the corresponding module is not enabled; Vault users intentionally do not receive the general sidebar.
The requested tab changes to another tab
If a bookmarked tab is not entitled, the hub selects the first visible tab. Confirm the organization’s modules instead of repeatedly using the old link.
Cannot assign a station to a tag
Bind a policy profile to the tag first. If seats are set, assigning beyond the seat cap fails until you free a seat or raise the package seats in Internal.
A change saves but the endpoint does not update
Confirm the endpoint is Online, has a recent heartbeat, runs the expected enforcing component, and reports an updated policy version. Refresh Managed devices and inspect module health. Confirm the station is a member of the tag bound to the profile you edited. Prefer Agent One 4.0.3587+ so Overview can show tags.
Security notes
- Use peer review for high-impact enforcement, unlock, uninstall, and rotation changes.
- Pilot a named profile on a small tagged set before binding a large seat pool.
- Never place unlock codes, uninstall codes, credentials, or sensitive evidence in change tickets.
- Treat Applied by as a prerequisite: a saved cloud setting cannot enforce through a missing or unhealthy agent.