Understanding Agents

How Velatir’s agents review traces, guide people, and decide what happens next.

What Are Agents?

Agents are the heart of Velatir. You do not trigger them by hand. They work in real time, applying the configuration you have set.

Velatir has three agents. Two of them review every trace. The third guides people as they use AI.

Gatekeeper

Controls which AI services your organisation can use. It enforces your default policy and any explicit exceptions, allowing or blocking services as people work.

Data Protector

Catches sensitive content before it leaves your environment, across credentials, personal data, and financial data.

Coach

Welcomes people on first use, introduces each service, and surfaces a brief reminder when patterns of use need attention.

Gatekeeper and Data Protector can review the same trace at once, each from its own angle. Coach does not issue an allow or block verdict on a prompt.

Data Protector is a paid add-on on Protection and Enterprise plans. Gatekeeper and Coach are included on Visibility.

Roles

Gatekeeper and Data Protector each run with a role that sets how much authority they have. The role decides what actually happens when the agent has a concern. Coach has no Observer or Enforcer role — it only delivers messages.

Observer

The agent reviews traces and flags its findings for review. It does not notify anyone or block anything.

Best for: the first weeks of a rollout, lower-risk workspaces, and building a picture of your usage before you enforce anything.

Enforcer

The agent blocks traces that break your rules. High-criticality findings also notify your connected channels.

Best for: workspaces handling sensitive data, regulated work, and any case where a violation must be prevented.

Outcomes

When a security agent reviews a trace, the result is one of these outcomes. Which one you see depends on the agent’s role and what it found.

Outcome	What it means
Allowed	No concern. The trace proceeds.
Flagged	An Observer noted a finding for review, without blocking.
Blocked	An Enforcer stopped the trace.
Escalated	A high-criticality finding also notified your channels. The prompt is not held waiting for a dashboard decision.

People still step in where it matters: Gatekeeper access requests and Data Protector false-positive challenges are review loops on the agent itself. Channel notifications are covered in Escalations.

How an Outcome Is Decided

1. Each security agent reviews the trace

   Gatekeeper and Data Protector review the trace at the same time, each recording its own assessment. Coach is not part of this verdict.

2. Roles decide the action

   An Observer only flags. An Enforcer can block. High criticality additionally notifies your channels.

3. The most restrictive outcome wins

   If either agent blocks, the trace is blocked. The trace proceeds only when nothing stands in its way.

Start Gatekeeper and Data Protector in Observer to learn what they catch, then promote to Enforcer where the risk justifies it. See Configuring agents.

---

Instructions

Teach an agent how to treat a specific scenario.

Assessments

Review every verdict an agent has reached.