> ## Documentation Index
> Fetch the complete documentation index at: https://docs.velatir.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Understanding Agents

> How Velatir's agents review traces, guide people, and decide what happens next.

## What Are Agents?

Agents are the heart of Velatir. You do not trigger them by hand. They work in real time, applying the configuration you have set.

Velatir has three agents. Two of them **review every trace**. The third **guides people** as they use AI.

<CardGroup cols={3}>
  <Card title="Gatekeeper" icon="brick-wall" href="/agents/gatekeeper">
    Controls which AI services your organisation can use. It enforces your default policy and any explicit exceptions, allowing or blocking services as people work.
  </Card>

  <Card title="Data Protector" icon="shield-check" href="/agents/data-protector">
    Catches sensitive content before it leaves your environment, across credentials, personal data, and financial data.
  </Card>

  <Card title="Coach" icon="graduation-cap" href="/agents/coach">
    Welcomes people on first use, introduces each service, and surfaces a brief reminder when patterns of use need attention.
  </Card>
</CardGroup>

Gatekeeper and Data Protector can review the same trace at once, each from its own angle. Coach does not issue an allow or block verdict on a prompt.

<Note>
  Data Protector is a paid add-on on Protection and Enterprise plans. Gatekeeper and Coach are included on Visibility.
</Note>

## Roles

Gatekeeper and Data Protector each run with a **role** that sets how much authority they have. The role decides what actually happens when the agent has a concern. Coach has no Observer or Enforcer role — it only delivers messages.

<AccordionGroup>
  <Accordion title="Observer" icon="eye">
    The agent reviews traces and flags its findings for review. It does not notify anyone or block anything.

    **Best for:** the first weeks of a rollout, lower-risk workspaces, and building a picture of your usage before you enforce anything.
  </Accordion>

  <Accordion title="Enforcer" icon="shield-check">
    The agent blocks traces that break your rules. High-criticality findings also notify your connected channels.

    **Best for:** workspaces handling sensitive data, regulated work, and any case where a violation must be prevented.
  </Accordion>
</AccordionGroup>

## Outcomes

When a security agent reviews a trace, the result is one of these outcomes. Which one you see depends on the agent's role and what it found.

| Outcome       | What it means                                                                                                    |
| ------------- | ---------------------------------------------------------------------------------------------------------------- |
| **Allowed**   | No concern. The trace proceeds.                                                                                  |
| **Flagged**   | An Observer noted a finding for review, without blocking.                                                        |
| **Blocked**   | An Enforcer stopped the trace.                                                                                   |
| **Escalated** | A high-criticality finding also notified your channels. The prompt is not held waiting for a dashboard decision. |

People still step in where it matters: [Gatekeeper access requests](/agents/gatekeeper#access-requests) and [Data Protector false-positive challenges](/agents/data-protector#false-positive-challenges) are review loops on the agent itself. Channel notifications are covered in [Escalations](/traces/escalations).

## How an Outcome Is Decided

<Steps>
  <Step title="Each security agent reviews the trace" icon="shield-check">
    Gatekeeper and Data Protector review the trace at the same time, each recording its own assessment. Coach is not part of this verdict.
  </Step>

  <Step title="Roles decide the action" icon="scale">
    An Observer only flags. An Enforcer can block. High criticality additionally notifies your channels.
  </Step>

  <Step title="The most restrictive outcome wins" icon="gavel">
    If either agent blocks, the trace is blocked. The trace proceeds only when nothing stands in its way.
  </Step>
</Steps>

<Tip>
  Start Gatekeeper and Data Protector in Observer to learn what they catch, then promote to Enforcer where the risk justifies it. See [Configuring agents](/agents/configuring-agents).
</Tip>

***

<CardGroup cols={2}>
  <Card title="Instructions" icon="fingerprint" href="/agents/instructions">
    Teach an agent how to treat a specific scenario.
  </Card>

  <Card title="Assessments" icon="list-checks" href="/agents/assessments">
    Review every verdict an agent has reached.
  </Card>
</CardGroup>