{"training":{"id":"T-APPROVAL-1","slug":"ask-before-an-agent-sends-or-publishes","title":"Ask before an agent sends or publishes","policyId":"P-TOOL-APPROVAL","minutes":3,"version":1,"lang":"en","assignment":{"happened":"On {date}, {agent} on {device} made a call through {tool} that acts outside the machine; {blocked}.","matters":"A {minutesWord} training shows which calls should wait for you, and what to read before you approve one."},"lesson":[{"id":"what-happened","heading":"What happened on {device}","body":["On {date} at {time}, {agent} on {device} made a call through {tool} during a session: {session}. qcontrol recorded it as: {evidence}.","The call acts outside your machine, and your agent was set to make it without asking, so the policy {policy} recorded a finding. {outcome}"],"illustration":{"scene":"unapproved-call","alt":"{agent} on {device} makes a call through {tool} that acts outside the machine.","animated":true}},{"id":"consequential","heading":"Which calls should wait for you","body":["Most of what an agent does stays on your machine: it reads files, searches and drafts. Some calls act on the world: they send mail, post a file, publish a page, delete something or run a command that reaches out.","Those cannot be taken back. A message sent is read, and a public link can be copied and found by search engines within minutes. When your request leaves the method open, such as \"share it with Sam\", the agent picks one."],"illustration":{"scene":"consequential-calls","alt":"Calls that read stay on your machine; calls that send, post, publish or delete act on the world and cannot be taken back."}},{"id":"what-qpoint-does","heading":"What Qpoint does about it","body":["qcontrol reads each call your agent makes. A call that sends, posts, publishes or deletes with approval set to never is a finding.","Under Observe the call runs and the finding records it. Under Enforce the call is held until a person approves it."],"illustration":{"scene":"policy-modes","alt":"The same call under each mode: Off lets it through, Observe lets it through and records it, Enforce stops it and records it."}},{"id":"instead","heading":"What to do instead","body":["Keep your agent asking before it sends, posts, publishes or deletes, and do not allow those calls for a whole session.","Say how in your request: \"email it to Sam\", \"a private link inside the company\". Before you approve a call, read where it goes and who can open it; a setting such as public: true is the one to catch.","If a call has already published something it should not have, take it down if you can, and tell {owner} what was posted and where."],"illustration":{"scene":"approve-call","alt":"{agent} asks before it sends or publishes; the request shows where it goes and who can open it, and you decline or say how."},"instead":true}],"check":[{"id":"q-which","prompt":"Which of these should your agent ask you about before it does it?","choices":[{"id":"a","text":"Reading a file in your project"},{"id":"b","text":"Searching your code for a function"},{"id":"c","text":"Posting a file to a public page","right":true}],"explain":"Posting a file where others can open it acts on the world and cannot be taken back. Reading and searching stay on your machine.","stepId":"consequential"},{"id":"q-how","prompt":"You ask your agent to \"share the export with Sam\". What decides how it shares it?","choices":[{"id":"a","text":"The agent, unless you say how","right":true},{"id":"b","text":"Your company's sharing settings"},{"id":"c","text":"Sam, who chooses how to receive it"}],"explain":"A request that leaves the method open leaves it to the agent. Say how, and read the call before you approve it.","stepId":"consequential"},{"id":"q-approve","prompt":"Your agent asks you to approve a call that shows public: true. What do you do?","choices":[{"id":"a","text":"Approve it; the agent chose the quickest way"},{"id":"b","text":"Decline it, and say how to share instead","right":true},{"id":"c","text":"Approve it, and delete the page later"}],"explain":"public: true means anyone with the link can open it. Decline it, and tell the agent how to share instead.","stepId":"instead"},{"id":"q-always","prompt":"Your agent offers to stop asking before it sends mail for the rest of the session. What do you choose?","choices":[{"id":"a","text":"Allow it; you will read the log afterwards"},{"id":"b","text":"Allow it for mail to people in your company"},{"id":"c","text":"Keep it asking before each send","right":true}],"explain":"Each send is a moment to catch a step you did not ask for. Keep the agent asking.","stepId":"instead"}],"contact":{"owner":"{owner}","how":"Contact IT from the message that brought you here, or reply to it; the replies reach {owner}."},"library":{"lesson":[{"id":"what-happened","heading":"What happens when an agent acts without asking","body":["Your agent on {device} makes calls as it works: it reads and searches, and sometimes it sends, posts or deletes. qcontrol reads each call and how it was approved.","When a call that acts outside your machine runs with approval set to never, the policy {policy} records a finding."],"illustration":{"scene":"unapproved-call","alt":"{agent} on {device} makes a call that acts outside the machine.","animated":true}}],"check":[]}},"version":1,"contentHash":"sha256:38bb5adc55221d1dd5cc61265bab72440a19de40c6aa749ba890306f01d236ea","slots":["agent","blocked","date","device","evidence","minutesWord","outcome","owner","policy","session","time","tool"],"path":"app/data/trainings/en/ask-before-an-agent-sends-or-publishes.md"}