13.3 The agent detail drawer

Click a hostname to open the drawer on the right. - Title: the hostname. - Subtitle: <user> · online|offline. - Close: the ✕ in the header.

The drawer has these sections, top to bottom.

13.3.1 Policy group

Behaviour: - Selecting a group assigns it manually. The banner reads “ assigned to group”“; the agent will receive the group policy on its next policy sync.” - Selecting the first option clears the manual assignment. The banner reads “ reverted to the default policy.” Automatic targeting then applies again. - When it takes effect: at the next policy sync (default ≤5 min). Use Restart to apply at once. - Audit: agent_group_assigned, with the group ID or → Default in Recent activity.

Group resolution order on the server: 1. Manual assignment. 2. The first enabled group in list order whose target matches (host pattern, OS, AD group/user/computer, or mail address). 3. Default.

13.3.2 License status

Same values as the License column: Licensed, Passive, Over limit, or —.

13.3.3 Active policies

What this machine actually receives now, computed by the server for the effective group (the subtitle shows the group name or “Default”). It is the same resolution the agent gets, including group-specific label overrides. Three chip lists:

Use this to answer “why does this user see / not see label X?” without touching the client.

13.3.4 Machine

13.3.5 Pending files

The files on this machine still waiting for: - a label (no rule matched), - a recommendation decision, or - masking.

This is what the agent reports now, not audit history. A file drops off as soon as it is labelled, masked, moved or deleted.

The inventory carries only file names and folders. It is sent compressed, with no size limit. The same data feeds the Unlabeled Files (current) report. The Pending files inventory switch is off by default.

13.3.6 Office add-ins

One pill per Office app reported by the agent. The header shows loaded/total.

macOS agents have no COM add-ins and show —.

13.3.7 Recent activity

A merged timeline, newest first, showing 8 entries. If there are more, it ends with “…and N older”. It combines: - the agent’s last 10 commands, each with a live status: pending, applied or FAILED, plus the issuer, the time and the agent’s result message - lifecycle events:

13.3.8 Diagnostics

This is the only way to collect a support bundle. The client has no button for it, so you cannot ask the user to produce one.

1. Click Collect diagnostics. The command is queued.
2. On its next heartbeat (≤60 s) the agent uploads a zip:
   • Windows: logs, versions, Office add-in registration, services, Event Log tail, and a network self-test.
   • macOS: also the ada-agent doctor output and launchd status.
   The agent token is excluded, and no policy content is included.
3. Click Refresh list. Each bundle shows its name, size and received time. Click the name to download.
4. Click × to delete a bundle. You are asked to confirm, and the deletion is audited as agent_diagnostics_deleted.

The server keeps the last 3 bundles per agent for 30 days, with a global cap. Upload is audited as agent_diagnostics_received.

13.3.9 Agent identity

How identities work: - Each agent generates its own key on the endpoint and enrols once with the setup token. - The server issues a certificate valid for one year. - The agent renews it automatically 30 days before expiry. If a renewal is missed, it re-enrols with its stored token, waiting for approval if approval is on.

Revoke identity (confirmation required) cuts off only this machine. It is rejected on its next request and must re-enrol. Use it when a machine’s key may be stolen. The rest of the fleet is untouched.

13.3.10 Remove Ada

If Issuing a remote agent uninstall is ticked under Administration → Settings → Security → Sign-in & access → Actions that require your password, both buttons ask for your console password first. The server enforces this, not just the console.