> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Violations

> Inspect policy and governance outcomes recorded as violations.

A violation is a durable occurrence created when a policy or governance
evaluation produces an outcome configured to record a violation. It preserves
the policy, triggering event, decision, enforcement result, and available
evidence at the time of the occurrence.

Not every policy evaluation creates a violation. Allowed activity and other
non-violation outcomes can still appear in session telemetry without appearing
here.

<Frame caption="Violations">
  <img src="https://mintcdn.com/forge-93b579e9/qWsC-LZodDrBBlxW/images/screenshots/violations.png?fit=max&auto=format&n=qWsC-LZodDrBBlxW&q=85&s=b42ca5bd4c9aa2132fa2103d5fca1416" alt="Forge Violations showing policy occurrences, actions, actors, events, findings, and summary metrics" width="3448" height="1916" data-path="images/screenshots/violations.png" />
</Frame>

## Summary

The page summarizes the selected time window with:

* Violation volume and the number of blocked outcomes.
* Distribution by category.
* Top AI systems or users.
* Total occurrences, linked findings, affected sessions, and unique policies.

Chart distributions are calculated from the returned violation records. The
table total and summary metrics represent the complete filtered result.

## Records

Each row identifies:

| Field      | Description                                                      |
| ---------- | ---------------------------------------------------------------- |
| Severity   | Severity stored with the policy occurrence.                      |
| AI product | Canonical AI product resolved for the event, when available.     |
| Policy     | Policy name and the version or source captured by the hit.       |
| Actor      | Resolved directory actor or the identity available on the event. |
| Action     | Decision action recorded by the evaluation.                      |
| Event      | Triggering event or tool action.                                 |
| Finding    | Linked finding, when the occurrence has one.                     |
| Occurred   | Time of the triggering event.                                    |

Filters include time range, policy source, outcome source, policy, action,
severity, evidence availability, finding link, AI product, directory user, and
device.

## Details

Opening a violation shows the data available for that occurrence:

* Policy, severity, action, AI product, actor, event time, enforcement method,
  and enforcement state.
* The triggering content or action and a link to the exact session event when
  both identifiers are available.
* Forge's recorded explanation for why the violation was created.
* Current event evidence and any earlier session evidence used by the
  governance decision.
* Product, policy, runtime, account, and source-capability fields returned by
  the backend evaluation.
* Nudge message or agent instruction when the policy decision included one.
* A linked finding when another detection record is associated with the
  occurrence.

Evidence sections are omitted when the source did not provide that data. A
violation without an exact session or event identifier cannot link directly to
the triggering event.

## Policy snapshots

Violation records retain hit-time policy identity and version information. The
current policy may later be edited, disabled, or deleted; the violation still
describes the policy and decision captured when the event occurred.

Use [Responses](/secure/responses) when the same governed activity created an
approval decision, grant, or session intervention.