How Sense AI is governed

Sense AI governance is the set of controls that decides what the Sense assistant, its agents and its nudges are allowed to read, change and show in your organization. Sense works inside the platform, not beside it. Every answer, every record change and every nudge goes through the same security, business rules and audit as a person doing the same thing. It runs under an identity you can name, uses only the tools you allow and stays within the limits you set. You hold these controls in Setup → Sense AI Studio, in your security profiles and in your licences. Read this page before you publish an agent that can change records or runs without a person present.

Overview

Governance rests on five things you control:

• Identity: whose access a run uses. A chat always runs as the person asking. Background runs use the agent's Execution account.
• Tools: which tools an agent can call. This is set by its Capability Grants, its Denied tools and your organization's licences.
• Approval: which tool calls stop and wait for a person to approve them.
• Nudges: where suggestions come from, and how often and how loudly each source speaks.
• Availability: whether Sense exists for a user at all. This depends on licensing, the module switches and audience teams.

The agent detail page (Setup → Sense AI Studio → Agents, then open an agent) shows most of this for one agent.

When to use it

• Before you publish a new agent, especially one that can change records or runs on a schedule.
• When you decide whether Sense may create or change records in your organization at all.
• When users say Sense told them something they should not see, or says it "has no tool" for a job.
• When a nudge source is too noisy, or a team should not reach a specialist agent.
• When you roll Sense out to some users and not others.

How xMatix handles it

Identity: who a run acts as

A chat turn always runs as the signed-in user. Entity, field and record access apply exactly as they do in the workspace. Two users can ask the same question and get different answers, and that is correct. Routing can hand a turn to a different agent. That changes the model, instructions and tools, but never whose access is used.

Background runs are queued, scheduled or event-triggered runs with nobody watching. They use the agent's Execution account, which is one of your organization's user accounts. That account's security profiles decide what the run can read and write. If no execution account is set, the run uses your organization's built-in system process identity. The agent page then shows System Process Fallback. Your xMatix operator can point that fallback at a dedicated, limited system agent user instead.

When you validate an agent, xMatix checks its execution account:

• The account must exist and be active.
• The account must have at least one active security profile.
• If no account is chosen, your organization must have a system process user to fall back on.

An agent that fails validation is never picked for a run.

Tools: granted, narrowed, licensed

What an agent can call comes from several layers, in this order:

1. Capabilities. Built-in tools are grouped into platform capabilities. Your own script tools and connected tool servers are bundled into tenant capabilities under Configuration → Capabilities.
2. Capability Grants on the agent (Instructions & Routing tab). If the list is empty, the agent inherits every enabled capability. If you select capabilities, the agent's tools are limited to those, within what your organization is licensed for. A grant never widens access beyond the platform and your licences.
3. Licences for premium capabilities. Some capabilities need a licensed add-on under the Sense AI product. Examples are Agent Web Tools (searching and reading public web pages), Agent Data Write (changing records) and Agent Nudges (agents publishing nudges). If your organization is not allocated the add-on, that capability is locked and its tools are never offered.
4. Denied tools on the agent. These tools are removed even when a granted capability includes them. The assistant's own interaction steps cannot be denied, such as asking you a question or listing what it can do.
5. Limits. Max tool calls bounds how many tool calls one run can make. For agents whose interaction mode is not Interactive, Max autonomous steps also caps it. Timeout (seconds) ends a run that takes too long.

The record-changing tools have extra rules. They create a record, change a record or run an action on a record. An agent is offered them only when all of these are true:

• the agent has Supports approvals on;
• a capability it holds, and your organization is licensed for, includes them;
• human approval is switched on for your xMatix service.

Even then, the agent changes only what the person or execution account behind the run is allowed to change.

Approval: when a person must say yes

Human approval of tool calls is a service-level switch held by your xMatix operator, not a setting on your screens.

• When approval is on, every record change pauses for a decision. That covers creating a record, changing a record and running an action on one. So do the tools on the approval list. By default the list includes report and dashboard drafts, script tools, connected-server tools and reading a web page. In chat, the user sees a card such as Create this record?, Change this record? or Run this action on the record?, with the proposed values, and chooses Approve or Decline. Nothing runs until they approve. If nobody decides within 10 minutes, the request is treated as declined. A background run that reaches an approval-gated tool pauses rather than running it.
• When approval is off, the record-changing tools are removed entirely. Sense can then read, explain and draft, but it cannot create or change records. Other tools on the approval list run without a prompt.

You can add to the approval list, never remove from it. Each agent's Approval-required tools field adds tools to the service and tenant lists, and takes effect only when approval is on and the agent supports approvals. The agent's Approvals flag on the detail page shows whether it takes part.

If something changes between the request and the decision, xMatix re-checks the tool when the user approves. The change could be a grant, a licence, the approval setting or a denied tool. If the tool is no longer allowed, nothing runs. The user is told: "This request can no longer run: changing records is no longer permitted for this assistant (its write access, licence or approval support changed after the request was made). Nothing was changed. Ask again if you still need it and the current setup allows it."

Instructions are guidance, not security

An agent's Additional Instructions, Input, Restrictions, Output format and Sensitive data rules steer what the model says. They do not enforce access. Hiding data is the job of field-level security and record access. Limiting actions is the job of grants, denied tools and approval. On an agent managed by a platform template, the template owns the routing text, capability grants and knowledge scope, and those fields are locked. The instructions and guardrails remain yours and survive template updates: Input, Restrictions, Output format, Denied tools, Approval-required tools, Sensitive data rules and When tools fail.

Nudges: four kinds of source

Nudges are the suggestions on record panels, list views and Sense Home. They come from four kinds of source, all listed under Configuration → Nudges:

• Built-in: signal providers that run fixed checks, such as dormant customers or overdue receivables. Only built-in sources accept threshold overrides.
• Rule: sources written as the Raise Nudge action of a business rule. You manage them under business rules.
• Agent: nudges published by one of your agents through its nudge tools.
• External: nudges sent in by another system through the nudge ingest endpoint. That endpoint accepts only callers that sign in as a user holding the Manage AI agents capability.

Treat the kind as part of the evidence. A built-in provider's logic is fixed and inspectable. An agent source depends on that agent's instructions, model and grants. An external source depends on who holds the account that sends it in. Whatever the source, a nudge never runs anything by itself. Its actions go through the normal application with the user's own access, so permissions, business rules, approvals and audit apply. Why? shows the evidence behind a nudge.

Activity is recorded

• An agent's background runs are listed on its Runs tab, with outcome, trigger, timing, any error and the stored transcript.
• Traces lists chat turns across your organization for 90 days, with the user, the agent that answered, the tools called and the model.
• Record changes made through Sense are ordinary audited edits.
• Nudge interactions are recorded per nudge and per user: impressions, clicks, Why? opens, apply, dismiss, snooze and thumbs up or down. They are kept for a year. They do not change how nudges are ranked. If users keep dismissing a source, you tune or switch it off yourself.
• Configuration → AI credits shows allowances and consumption. When a user's allowance and the shared pool are used up, Sense refuses further turns until the next period or a larger allocation.

Availability: who sees Sense at all

A user sees the Sense chat only when all three of these are true:

1. Licence. Their security profile holds the Sense AI product. Every security profile holds it by default.
2. Module switch. The Sense AI module is on in Sense AI settings. Turning it off hides Sense for everyone, even users who hold the product.
3. A reachable agent. An agent the router can send the user to exists. Agents that are inactive or failed validation are skipped. So are agents limited to Audience teams the user is not in.

Nudges have their own switch: Enable Sense AI nudges, on by default. When it is off, nudge surfaces hide and nudge computation stops, while chat stays available. The module switch always wins over the nudges switch.

Prerequisites

• The Manage AI agents capability, to manage agents, capabilities, nudges, external assistants and traces. Manage AI models is needed for models, and Licensing administration for AI credits.
• The Feature Hub capability for Sense AI settings, if you change the module switches.
• Setup → Access control → Profiles access, if you scope execution accounts or remove Sense from profiles.

Procedure

Step 1 — Review an agent's governance

Open Setup → Sense AI Studio → Agents and open the agent. On Overview, read:

• Execution Account: who background runs act as.
• Interaction Mode: Interactive, Autonomous or Hybrid.
• Active, Supports Chat, Queued Runs, Scheduling and Approvals.
• The limits: Max Tool Calls, Max Autonomous Steps, Timeout Seconds and Concurrency Limit.
• Audience Teams, in the routing summary.

Then open Instructions & Routing and read Capability Grants, Denied tools, Approval-required tools and Knowledge Collections.

Step 2 — Scope the execution account

Before an agent runs unattended, click Edit and choose an Execution account with only the access the job needs. Use a dedicated, active user with a narrow security profile, not an administrator. Save, then click Validate. The agent's validation must read Ready. If it reports an execution-account problem, see Common problems.

Step 3 — Narrow the tools

On Instructions & Routing, select only the capabilities the agent needs in Capability Grants. Add any individual tool it must never use to Denied tools. Click Save, then Validate. Validation warns you when a name in Denied tools or Approval-required tools is not a built-in tool name, because such a name has no effect.

Step 4 — Decide on approvals

For an agent that should be able to change records:

1. Turn on Supports approvals in Edit.
2. Grant a capability that includes the record tools. Your organization needs the licence for it.
3. Confirm with your xMatix operator that human approval is on for your service.

Add any further tools that should wait for a person to Approval-required tools. Test both Approve and Decline in a sandbox.

Step 5 — Limit who can reach a specialist agent

In Edit, pick Audience teams. Only members of those teams are routed to the agent. Leave the field empty to let every Sense user reach it.

Step 6 — Tune or silence a nudge source

Open Configuration → Nudges and click Edit on the source. You can change:

• Enabled;
• Dismissal cooldown (hours);
• Max nudges per view;
• for built-in sources, Threshold overrides (JSON) and the entities they watch.

Reset to defaults clears your override. For the full procedure, see Enable and configure Sense nudges.

Step 7 — Set the organization-wide switches

Open Configuration → Sense AI settings:

• Set the module switch.
• Set Enable Sense AI nudges.
• Set Show AI model in assistant chat. It is off by default, so model and provider names stay hidden from users.
• Set Remember users across conversations. It is on by default. It lets the assistant keep long-term memory per user, and each user can review or forget theirs from the chat's Memory panel.

Open Configuration → External assistants to decide:

• whether outside AI assistants may connect at all (Allow external assistants);
• whether they may write (Allow writes);
• which assistants are approved.

You can also disconnect a user's assistant there.

Step 8 — Audit what ran

For background runs, open the agent's Runs tab and click a run to see its outcome, any error and its transcript. For chat turns, open Traces and check the user, the agent that answered and the tools called.

Fields

These are the agent settings that carry governance. The other agent fields are covered in Create an AI agent in AI Studio.

Business rules

• A chat turn never runs as the execution account; it always runs as the signed-in user.
• A background run whose agent has no execution account runs as the system process identity, or as the dedicated system agent user if your operator has set one.
• An agent is never picked for a run if it is inactive or failed validation. For a chat it must support chat, and for a background run it must support queued runs.
• Record-changing tools always require approval when approval is on, whatever the approval lists say, and are removed when it is off.
• Approval lists only ever grow: the service default, plus your tenant list, plus each agent's own list.
• A pending approval is re-checked against the current grants, licences and denials when it is decided.
• A live approval card that gets no decision within 10 minutes is treated as declined.
• A disabled nudge source stops producing nudges from its next compute cycle, and its existing nudges retire.
• Nudge feedback is recorded and kept for 365 days. Resolved nudges are removed after 90 days. Feedback does not re-rank nudges.

Example

A distributor wants a "Collections assistant" agent. It should draft follow-up notes in chat and add a weekly reminder nudge to each overdue customer.

1. The administrator opens the agent and sets Interaction Mode to Hybrid. They turn on Supports approvals and Supports scheduling.
2. They choose the execution account collections.bot. It is an active user whose only profile can read customers and invoices and create activities.
3. On Instructions & Routing, they grant only the capabilities for reading records, changing records and publishing nudges. The organization holds the Agent Data Write and Agent Nudges add-ons. They add web reading to Denied tools.
4. They pick the Credit Control team in Audience teams and click Validate. The agent shows Ready.
5. A credit controller asks Sense to log a call note on an overdue customer. The chat shows Create this record? with the proposed values. The controller clicks Approve, and the note is saved as an ordinary audited record under the controller's own name.
6. The weekly run publishes nudges as collections.bot. Each nudge's Why? shows the overdue invoices behind it.

Training

Practice exercise

In a sandbox:

1. Open any active agent and note its Execution Account. Add a tool to Denied tools that is in one of its granted capabilities, save, and click Validate.
2. Ask the agent in chat to do something that needs that tool. Expected result: the agent says it cannot do it, and the turn in Traces shows the tool was not called.
3. Type a made-up name into Approval-required tools and validate. Expected result: validation warns that the name is not a built-in tool and has no effect.
4. Remove both entries and validate again.

Quick reference

• Chat always runs as the person asking. The execution account is for background runs only.
• Empty Capability Grants means every enabled capability, so select grants deliberately.
• Denied tools beat grants. Approval lists only add.
• Approval on: every record change asks first. Approval off: Sense cannot change records.
• Instructions and Sensitive data rules guide the model. They are not security.
• Audience teams decide who can reach an agent.
• Disable a noisy nudge source under Configuration → Nudges. Feedback does not tune it for you.
• The Sense AI module switch beats every other Sense setting.

Permissions

A user without the capability does not see the menu item. A user whose profiles do not hold Sense AI sees no chat, and no nudges.

Configuration

These are held by your xMatix operator rather than on your screens:

• whether human approval is on;
• the default approval list;
• whether capability grants are enforced for built-in read tools;
• the platform AI credit grant and free daily tier;
• the dedicated system agent fallback.

Common problems

Sense says it has no tool to create or change records

Record-changing tools are offered only when all of these are true:

• human approval is on for your service;
• the agent has Supports approvals on;
• a capability it holds includes the record tools;
• your organization is licensed for that capability.

Check the agent's flags and grants, check your licences, and ask your operator whether approval is on.

Validation says "Selected execution account is inactive."

The chosen user was deactivated. Choose another active account, or reactivate the user, then validate again.

Validation says "Selected execution account must have at least one active security profile assignment."

Assign the user a narrow, active security profile, or choose another account.

Validation says "No execution account was selected and this tenant has no system process user fallback."

Choose an execution account. If you need the fallback, contact your xMatix operator.

An approved request says "This request can no longer run"

Something changed between the request and the decision: the agent's grants, a denied tool, its approval support or your licence. Nothing was changed. Ask Sense again; it will offer only what the current setup allows.

Validation warns "not built-in tool names, so they have no effect"

A name in Denied tools or Approval-required tools is misspelled or is not a built-in tool. Pick names from the list. Script tools and connected tools are controlled through their capabilities.

A team cannot reach a specialist agent

The agent is limited to Audience teams the users are not in, or it is inactive or failed validation. Add the team, or clear the list.

Nudges disappeared but chat still works

Enable Sense AI nudges is off, or the source was disabled under Configuration → Nudges.

Common questions

Can Sense change data without a person involved?

Not by creating or changing records, or by running actions on them. When approval is on, every record change waits for someone to approve it, and a background run pauses rather than running it. When approval is off, those tools are removed. Other tools behave differently. An agent's nudges, its drafts and its script or connected tools run without a prompt unless they are on an approval list and approval is on. So keep grants narrow, use a scoped execution account, add risky tools to Approval-required tools or Denied tools, and review the Runs tab and Traces.

Can Sense reveal something a user isn't allowed to see?

Not in chat. Every chat turn runs as the asking user, whichever agent answers, so Sense reads only what that user's profiles allow. The execution account matters for background runs. A scheduled run under a broad account can read more than any one user, and anything it writes into shared records is then visible to whoever can open them. Note that the cross-record nudge feed on Sense Home is filtered by status and target user, not by each record's access. Scope access on the execution account and in security, not in instructions.

How do I roll Sense out to some users and not others?

Remove the Sense AI product from the security profiles that should not have it. Those users then see no chat and no nudges. To limit a specialist agent, use Audience teams. Usage is governed per user by the free daily tier and any AI credits you assign. To switch Sense off for everyone, turn the module off in Sense AI settings.

Where do I see what a run actually did?

For a chat turn, open Traces (the last 90 days): each turn shows the user, the agent that answered, the tools called and the model. For a background run, open the agent's Runs tab and click the run to see its outcome, any error and its transcript. On a nudge, Why? shows the evidence its source used.

Related topics

• Sense AI Studio
• Create an AI agent in AI Studio
• Asking Sense about your data
• Enable and configure Sense nudges
• External assistants
• How xMatix approaches AI trust
• How the xMatix security model works
• Managing security profiles
• Licensing