Delete or Block an Identity
Clean up a stale identity that never made a real request, or cut off a misbehaving agent's traffic with a generated policy — both from the Identities page, no policy YAML required. Requires an admin role.
Delete a stale identity
Identities are derived from observed traffic, not a manually-managed list — a row with no real activity (an agent that was set up but never called anything, or a developer who never connected) can be removed.
Navigate to Inventory → Identities. A Delete action appears in the row's actions column only for identities that qualify as stale: zero requests ever, or no activity in the last 30 days.
Click Delete and confirm. The row is removed immediately.
An identity with recent activity never shows the Delete action — it would just be recreated on its next request anyway. If you need to stop an active identity instead, use Block below.
Block an identity
Blocking generates and enables a deny policy scoped to the identity, so you don't have to write CEL by hand for a quick kill switch — for example, cutting off a governed agent mid-demo if it starts misbehaving.
Navigate to Inventory → Identities and click Block on the row for the identity you want to stop.
Choose the scope:
- All traffic — blocks both MCP tool calls and LLM calls from this identity.
- MCP tool calls only — leaves LLM calls governed by ordinary policy.
- LLM calls only — leaves MCP tool calls governed by ordinary policy.
Optionally enter a reason — shown to the blocked identity as part of the denial message (for example, "credentials are being rotated"). Leave it blank to use a generic message.
Optionally check Show my identity to the blocked user to have the denial message name you as the admin who blocked them, instead of a generic "your administrator". This is off by default — your name and the reason you entered are always visible to other admins on the Policies page either way.
Click Block. A policy named
identity-block-<identity>is created and enabled immediately — the identity's next matching request is denied with your message. The row shows a Blocked tag.
Unblock
Click Unblock on the row's Blocked tag. This deletes the generated policy — the identity's traffic is governed by ordinary policy again, exactly as before it was blocked.
A block created by Revoke agent access... on a security incident or finding is the same policy, so it shows Blocked here too and Unblock restores it (a block for a workload has no identity page: delete its policy under Security → Policies). See Contain an agent from an incident.
You can also find and delete the generated policy directly from Security → Policies if you'd rather manage it there — it's an ordinary policy like any other, just named with an identity-block- prefix so the Identities page can find it again.
Block and Delete are independent: an identity can be blocked without being stale (it's still making requests, they're just all denied), and a stale identity that's never made a request has nothing to block.