What the Dashboard Shows
AIEGIS enforces AI policy silently in the background. When an employee's browser or desktop app sends a request to an AI vendor (ChatGPT, Claude, Gemini, etc.) that violates policy, AIEGIS blocks or warns — and logs that event. The IT Dashboard is the window into all of those events.
| Feature | What It Does |
|---|---|
| Stats Bar | Live counts of blocks, warnings, pending reviews, and 24-hour activity |
| Violations Table | Every flagged AI interaction — agent, action, decision, threats detected, timestamp |
| IT Actions | Log responses: notify employee, add note, escalate, recommend training, mark done |
| Filter Bar | Filter by decision type (Block / Warn) or review status (Pending / Reviewed) |
| Auto-refresh | Table refreshes every 30 seconds. No manual reload needed. |
The dashboard does not modify employee behaviour directly. AIEGIS does that in real time. The dashboard is your audit trail and response log.
What the Dashboard Does Not Show
AIEGIS is scoped to AI traffic only. You will not see general web browsing, email, or non-AI application activity. Requests that passed AIEGIS with an ALLOW decision do not appear in the violations table.
URL Format
Replace YOUR_ADMIN_KEY with the admin key provided by your AIEGIS deployment owner. Treat the URL like a password — do not share it externally.
Bookmark the dashboard URL with your key included. If you suspect the key is compromised, contact your deployment owner immediately to rotate it.
Without a Key
If you visit /it/violations without a key, the table displays an authentication error. No violation data is exposed without the key.
| Stat | Meaning | When To Act |
|---|---|---|
| Total Violations | All blocks + warnings since deployment | Baseline reference |
| Blocked | Requests stopped before reaching the AI vendor | Review all — real enforcement occurred |
| Warnings | Requests that passed but were logged | Spot-check regularly for patterns |
| Pending Review | Violations not yet actioned by IT | Clear this queue daily |
| Reviewed | Violations where an IT action was taken | Audit trail — no action needed |
| Last 24 Hours | New violations in the past 24 hours | A spike here means investigate now |
Column Breakdown
| Column | What It Shows |
|---|---|
| Agent | Name and ID of the AI agent or tool that triggered the violation. Name is set at registration; ID is the system identifier. |
| Action / Target | What the agent was trying to do and where — e.g. "Send message" to api.openai.com. |
| Decision | BLOCK (stopped) or WARN (passed with flag). See Chapter 10. |
| Threats | Which AIEGIS layers flagged the request. Hover tags for full detail. See Chapter 11 for layer definitions. |
| Time | When the event occurred, in your local timezone. |
| IT Actions | Buttons to log your response. Actions taken appear as tags below the buttons. Reviewed rows are dimmed. |
Decision Filter
Status Filter
Start with Blocks Only + Pending Review. Clear that queue first. Then switch to All Decisions + Pending Review for warnings. End with a scan of Last 24h in All Decisions view.
Clicking "Done" marks the violation reviewed in AIEGIS only. It does not notify the employee or trigger any external system. All notifications and escalations must be done manually.
Logs that you notified the employee about the violation. Does not send a notification automatically — you still need to contact them directly via your normal channel.
Opens a text field for a free-form investigator note. Notes are stored with the violation record and visible when you revisit it later.
Logs that the violation has been escalated to incident response. Use for violations that represent a genuine security concern beyond IT review.
Logs a training recommendation. Use when a block appears to be a policy misunderstanding — the employee needs guidance on what AIEGIS allows and why.
Marks the violation as reviewed. The row dims and leaves the Pending queue. Always click Done when finished reviewing, even if you took no other action.
Notes are part of your audit trail. Write them as if a colleague will read them in six months — because they might. Avoid abbreviations that only make sense in the moment.
When to Escalate
| Signal | Recommended Action |
|---|---|
| Multiple BLOCK violations from the same agent in a short window | Escalate — may indicate a rogue or compromised agent |
| Threat tags reference data exfiltration (L8, L12) | Escalate + notify employee immediately |
| Agent ID is unknown or not registered in your organisation | Escalate — unauthorised agent accessing AI infrastructure |
| Single isolated block from a known agent doing routine work | Note + Done — likely false positive |
| Repeated warnings from same agent, boundary being tested | Training recommendation + monitor |
Clicking "Escalate" logs the action in the dashboard only. Your organisation is responsible for the actual escalation process — email to your security team, incident management ticket, or your defined IR procedure. AIEGIS gives you the evidence; you drive the response.
| Decision | What Happened | Employee Experience | IT Priority |
|---|---|---|---|
| BLOCK | AIEGIS intercepted the request before it reached the AI vendor. The request never left the device. | Browser extension: fetch call returns a synthetic 403. Mac agent: request is silently dropped. The employee's tool may show an error or timeout. | High — review within the working day |
| WARN | AIEGIS flagged the request but allowed it through. The AI vendor received the request and responded normally. | No visible change. The interaction completed normally. | Medium — clear within the week |
| REVIEWED | An IT administrator took an action on this violation and marked it done. | No employee impact | Closed — audit trail preserved |
| Layer | Category | What It Catches |
|---|---|---|
| L1 | Agent Identity | Unregistered or spoofed agent identities |
| L2 | Language Baseline | Communication outside expected language patterns |
| L3 | Transport Security | Unencrypted or invalid certificate connections |
| L4 | Prompt Injection | Attempts to hijack or redirect AI instructions |
| L5 | Data Leakage | PII, credentials, or sensitive data in outbound requests |
| L6 | Authorisation | Requests outside the agent's permitted scope |
| L7 | Rate & Quota | Abnormal request volumes or quota abuse |
| L8 | Exfiltration | Data moving to unexpected external destinations |
| L9 | Meta-Security | Requests about the security system itself |
| L10 | Behavioural | Unusual patterns in agent behaviour over time |
| L11 | Payload Analysis | Malicious or policy-violating content in the request body |
| L12 | Governance | EU AI Act and compliance framework violations |
| L13 | MCP Registry | Unregistered or unauthorised tool use in MCP contexts |
| L14 | Session Integrity | Replayed, forged, or tampered sessions |
| L15 | Audit | Events that bypass or interfere with the audit trail |
A single violation can be flagged by more than one layer. A request containing PII sent over an unencrypted channel shows both L3 and L5 threat tags. The decision (BLOCK or WARN) is determined by the most severe layer that triggered.
Authentication Error in the Table
"Authentication required — add ?key=YOUR_ADMIN_KEY to the URL" appears in the table body.
You are viewing the dashboard without a valid admin key. Add ?key=YOUR_KEY to the URL. If you do not know the key, contact your AIEGIS deployment owner.
Stats Bar Shows Dashes
The stats API returned an error. This can happen when the AIEGIS service is restarting or the admin key is invalid. Wait 30 seconds and refresh. If it persists, verify the service status with your deployment owner.
Table Shows No Violations
Either no violations have occurred (normal for a new deployment), or the current filter is too narrow. Clear all filters and click Refresh. If you expect violations but see none, verify that employees have the browser extension installed and active.
Action Buttons Are Unresponsive
Check your browser console for JavaScript errors. Ensure your admin key is still in the URL — navigating within the page can lose it. Reload the full URL including the key.
Technical documentation at /developer. For deployment issues, contact your AIEGIS deployment owner or support@aiegis.ie.