Skip to main content

Delete or Block an Identity

Tasks

Clean up a stale identity that never made a real request, or cut off a misbehaving agent's traffic with a generated policy — both from the Identities page, no policy YAML required. Requires an admin role.

Delete a stale identity

Identities are derived from observed traffic, not a manually-managed list — a row with no real activity (an agent that was set up but never called anything, or a developer who never connected) can be removed.

  1. Navigate to Inventory → Identities. A Delete action appears in the row's actions column only for identities that qualify as stale: zero requests ever, or no activity in the last 30 days.

  2. Click Delete and confirm. The row is removed immediately.

An identity with recent activity never shows the Delete action — it would just be recreated on its next request anyway. If you need to stop an active identity instead, use Block below.

Block an identity

Blocking generates and enables a deny policy scoped to the identity, so you don't have to write CEL by hand for a quick kill switch — for example, cutting off a governed agent mid-demo if it starts misbehaving.

  1. Navigate to Inventory → Identities and click Block on the row for the identity you want to stop.

  2. Choose the scope:

    • All traffic — blocks both MCP tool calls and LLM calls from this identity.
    • MCP tool calls only — leaves LLM calls governed by ordinary policy.
    • LLM calls only — leaves MCP tool calls governed by ordinary policy.
  3. Optionally enter a reason — shown to the blocked identity as part of the denial message (for example, "credentials are being rotated"). Leave it blank to use a generic message.

  4. Optionally check Show my identity to the blocked user to have the denial message name you as the admin who blocked them, instead of a generic "your administrator". This is off by default — your name and the reason you entered are always visible to other admins on the Policies page either way.

  5. Click Block. A policy named identity-block-<identity> is created and enabled immediately — the identity's next matching request is denied with your message. The row shows a Blocked tag.

Unblock

Click Unblock on the row's Blocked tag. This deletes the generated policy — the identity's traffic is governed by ordinary policy again, exactly as before it was blocked.

You can also find and delete the generated policy directly from Security → Policies if you'd rather manage it there — it's an ordinary policy like any other, just named with an identity-block- prefix so the Identities page can find it again.

note

Block and Delete are independent: an identity can be blocked without being stale (it's still making requests, they're just all denied), and a stale identity that's never made a request has nothing to block.

See also