Incidents are where you review, triage, and resolve policy violations across Knowledge and Chat from a single dashboard. Every time a control fires — whether it blocked, restricted, or just flagged — it writes an incident here.
Overview
An incident is a logged record of a control being triggered. Whenever a control fires through a policy, it writes an incident naming the control, the policy it came through, what was caught, and when. Incidents live under Governance › Incidents, on separate Chat and Knowledge tabs, and you can filter the list by Status, Action, Policy, and a Detected date range.
Statuses
| Status | Meaning |
| Open | Newly raised, not yet looked at. |
| In Progress | Someone is investigating. |
| Resolved | Dealt with. |
| False Positive | The control fired but it wasn't a real violation. |
Marking false positives is useful feedback — a control that produces many of them is probably too broad and worth tuning.
Actions: Blocked, Restricted, and Flagged
The Action column tells you what actually happened when the control fired: Blocked (Chat) stopped the request or response; Restricted (Knowledge) hid the matching content from search results; Flagged (both surfaces) let it through but logged it here for review. Masked and Redacted (Chat) mean the matched text was replaced with a mask token or stripped, and the rest of the content went through. These outcomes appear only for checks that support them. Flagged incidents may need a closer look since they got through; Blocked and Restricted incidents are ones the guardrail already acted on.
Triaging an incident
Open an incident to see its full detail and work it. Set its Status and an Assigned to owner — it reads Unassigned until you pick someone — and add Notes to record what you found or did. Click Save to record your changes; triage isn't auto-saved. Incidents can't be deleted, since they're an audit trail, so you resolve them rather than remove them. Only the status, assignee, and notes are editable.
What an incident shows you
The incident detail opens with a banner for the action taken, then an Overview (Check type, Confidence, Severity, the User and Source for Chat or the Owner for Knowledge, and when it was Detected), the Control violated section (which control was hit and the policy it belongs to, with links to open either), the Content (the conversation snippet and a View trace link for Chat, or the matched content for Knowledge), and your triage Notes.
What's in This Section
| Tab | What it covers |
| Chat | Incidents raised by controls guarding live agent conversations and tool use. |
| Knowledge | Incidents raised by controls guarding indexed knowledge content. |