Skip to main content
A violation is a durable occurrence created when a policy or governance evaluation produces an outcome configured to record a violation. It preserves the policy, triggering event, decision, enforcement result, and available evidence at the time of the occurrence. Not every policy evaluation creates a violation. Allowed activity and other non-violation outcomes can still appear in session telemetry without appearing here.
Forge Violations showing policy occurrences, actions, actors, events, findings, and summary metrics

Violations

​
Summary

The page summarizes the selected time window with:
  • Violation volume and the number of blocked outcomes.
  • Distribution by category.
  • Top AI systems or users.
  • Total occurrences, linked findings, affected sessions, and unique policies.
Chart distributions are calculated from the returned violation records. The table total and summary metrics represent the complete filtered result.

​
Records

Each row identifies: Filters include time range, policy source, outcome source, policy, action, severity, evidence availability, finding link, AI product, directory user, and device.

​
Details

Opening a violation shows the data available for that occurrence:
  • Policy, severity, action, AI product, actor, event time, enforcement method, and enforcement state.
  • The triggering content or action and a link to the exact session event when both identifiers are available.
  • Forge’s recorded explanation for why the violation was created.
  • Current event evidence and any earlier session evidence used by the governance decision.
  • Product, policy, runtime, account, and source-capability fields returned by the backend evaluation.
  • Nudge message or agent instruction when the policy decision included one.
  • A linked finding when another detection record is associated with the occurrence.
Evidence sections are omitted when the source did not provide that data. A violation without an exact session or event identifier cannot link directly to the triggering event.

​
Policy snapshots

Violation records retain hit-time policy identity and version information. The current policy may later be edited, disabled, or deleted; the violation still describes the policy and decision captured when the event occurred. Use Responses when the same governed activity created an approval decision, grant, or session intervention.