Remediation

Access policies can authorize a response in addition to returning an access decision. Forge executes a remediation only when the policy, action, enforcement source, target evidence, and configured lifecycle phase are all compatible.

Fleet actions

Fleet actions let an operator validate an installation, repair the Forge deployment, or rotate its enrollment token on an exact set of selected devices. Before execution, Forge checks that every selected device can receive the requested action and shows the intended targets for review. A readiness result does not expand the selection to other devices in the same group or source. After confirmation, the action view reports progress and the result for each device. Forge reads back device state so a successful request can be distinguished from a completed change. If only part of the selection succeeds, the successful devices remain complete and the remaining devices can be retried without rerunning the action across the full fleet.

Runtime

The optional runtime object controls how Access policies handle candidate AI activity and enhanced detection.

Field	Values or limits	Meaning
`candidateMode`	`default_allow_async`, `enhanced_runtime_hold`, `strict_fail_closed`	Whether candidate activity proceeds, waits, or is denied
`detectionMode`	`disabled`, `async_only`, `enhanced_runtime_detection`	Whether Forge performs additional runtime detection
`detectionLatencyMs`	integer, 1–10,000	Maximum configured enhanced-detection latency
`timeoutBehavior`	`policy_action`	Uses the policy’s configured action after a detection timeout
`failBehavior`	`fail_open`, `fail_closed`	Result when required runtime detection fails
`confidenceThreshold`	number, 0–1	Minimum confidence for the enhanced result

These settings affect runtime classification. They do not authorize an endpoint or provider operation by themselves.

Remediation object

{
  "remediation": {
    "triggerPhase": "post_block_cleanup",
    "applyWhenClassification": "known_ai",
    "actions": [
      {
        "surface": "desktop_process",
        "action": "forceTerminate",
        "target": "process:example"
      }
    ]
  }
}

Field	Required	Meaning
`triggerPhase`	Yes	Lifecycle point at which the authorized actions may run
`applyWhenClassification`	No	Limits execution to `known_ai`, `candidate_ai`, or `not_ai`
`actions`	Yes	1–64 unique surface/action authorizations
`actions[].surface`	Yes	Kind of asset or control boundary to change
`actions[].action`	Yes	Exact operation authorized on that surface
`actions[].target`	Sometimes	Exact catalog/resource identifier; may be derived from conditions

Trigger phases

Not every phase is valid for every policy action.

Policy action	Valid `triggerPhase` values
`allow`	`runtime_match`, `async_confirmed`
`flag_for_review`	`runtime_match`, `async_confirmed`, `review_execution`
`require_approval`	`approval_response`
`block`	`runtime_match`, `post_block_cleanup`

require_approval denies or holds the initial operation. Any cleanup is an explicit part of resolving that request, not an automatic side effect of the initial match.

Surfaces

Surface	Target represented
`website_runtime_host`	Website host observed at runtime
`website_auth_host`	Authentication host associated with the website
`website_api_host`	API host used by the website
`provider_api`	Provider-managed account or resource
`desktop_process`	Running desktop process
`bundle_identifier`	Installed application bundle
`package_identifier`	Installed package or binary
`browser_extension`	Browser extension
`ide_extension`	IDE plugin or extension
`local_runtime`	Local AI runtime
`mcp_server`	Managed MCP server configuration
`mcp_tool`	Managed MCP tool configuration
`profile_only`	Governance profile without a direct runtime target
`active_indicator`	Evidence marking an active AI asset
`candidate_indicator`	Evidence marking a candidate AI asset
`not_ai_suppression`	Classification suppression for a proven non-AI asset

The Console loads the backend-owned remediation catalog and shows only actions eligible for the selected surface, policy action, trigger phase, and installed integrations.

Action reference

Browser and account

Action	Requested operation
`clearAuthCookies`	Remove authentication cookies for the proven site/account scope
`clearCacheStorage`	Delete browser Cache Storage for the target origin
`clearCookies`	Delete cookies for the target origin
`clearExtensionStateWhenProven`	Clear extension state after extension ownership is proven
`clearIndexedDb`	Delete IndexedDB data for the target origin
`clearServiceWorkers`	Unregister service workers for the target origin
`clearSiteStorage`	Clear the integration’s supported site-storage set
`clearStorage`	Clear supported application-local storage
`closeTabOrWindow`	Close the matched browser tab or application window
`disableAccountWhenProven`	Disable a provider account after identity and authority are proven
`disableOAuthGrantWhenProven`	Disable the proven OAuth grant
`removeSitePermissions`	Revoke permissions granted to the target site or origin
`revokeTokenWhenProven`	Revoke the matched token after identity and ownership are proven
`rotateSecretWhenProven`	Rotate the matched secret after identity and ownership are proven

Processes and applications

Action	Requested operation
`disableLaunchService`	Disable the matched operating-system launch service
`disableLoginItem`	Disable the matched startup item
`forceTerminate`	Immediately terminate the target process or application
`gracefulQuit`	Ask the target application to exit cleanly
`killHelperProcess`	Terminate an attributed helper or child process
`managedUninstall`	Uninstall the target through its management integration
`uninstallApp`	Uninstall the proven application bundle
`preventReinstall`	Apply a control that prevents the target from being reinstalled
`quarantine`	Apply the integration’s quarantine operation
`quarantineBinary`	Quarantine the proven executable binary
`quarantineRuntime`	Quarantine the proven runtime environment
`removePackageWhenOwned`	Remove a package only when target ownership is proven
`stopCallerProcessWhenProven`	Stop the process that initiated the activity after attribution is proven
`stopContainerWhenKnown`	Stop the containing runtime when its identity is known
`stopLocalServerProcess`	Stop the matched local server process
`stopServer`	Stop the target server through its managing integration
`terminateRuntime`	Terminate the matched runtime or runtime session

Managed configuration

Action	Requested operation
`disableManagedExtension`	Disable a browser extension through its managing control plane
`disableManagedPlugin`	Disable a managed IDE plugin
`disableManagedServerConfig`	Disable a managed MCP server configuration
`disableManagedToolConfig`	Disable a managed MCP tool configuration
`preventManagedPluginReinstall`	Prevent the managed plugin from being restored
`preventManagedServerReinstall`	Prevent the managed MCP server configuration from being restored
`preventManagedToolReinstall`	Prevent the managed MCP tool configuration from being restored
`removeManagedConfigEntry`	Remove one proven entry from managed configuration
`removeManagedConfiguration`	Remove the complete proven managed configuration
`removeManagedExtension`	Remove an extension through its managing control plane
`removeManagedPlugin`	Remove an IDE plugin through its managing control plane
`removePluginConfigWhenProven`	Remove plugin configuration after target ownership is proven
`repairApprovedExtension`	Restore the approved managed extension configuration
`repairManagedPlugin`	Restore the approved managed plugin configuration
`repairManagedServerConfig`	Restore the approved managed MCP server configuration
`repairManagedToolConfig`	Restore the approved managed MCP tool configuration
`recordOnly`	Record the remediation decision without changing a target

Targets

Forge can derive a target only from a positive eq or in condition on a field compatible with the chosen action. Negated conditions never authorize a target. Examples of derivable target fields include:

Target type	Compatible condition fields
Website or browser data	`destination.domain`, sometimes `browser.account_id`
Browser extension	`browser.extension_id`
Process or runtime	`process.id`
Account or token	`browser.account_id`, `account.profile_id`, or destination

If target is omitted, exactly one compatible target must be derivable. Explicit targets must also be selected by a compatible positive condition. recordOnly is the only targetless remediation. Actions containing WhenProven or WhenKnown are conditional by design. Insufficient evidence or an incapable integration produces a remediation diagnostic; Forge does not guess a target or report success.

Get started

Observe

Secure

Enable

Integrations

Resources

Fleet actions

Runtime

Remediation object

Trigger phases

Surfaces

Action reference

Browser and account

Processes and applications

Managed configuration

Targets

​Fleet actions

​Runtime

​Remediation object

​Trigger phases

​Surfaces

​Action reference

​Browser and account

​Processes and applications

​Managed configuration

​Targets

Fleet actions

Runtime

Remediation object

Trigger phases

Surfaces

Action reference

Browser and account

Processes and applications

Managed configuration

Targets