---
title: "Operating Profiles"
description: "Declare what an agent is for, the systems it reaches, and what it must never do, check the declaration against what the agent was seen doing, and save it as a version."
source: "Guardian Platform"
---
## About operating profiles

An operating profile is an agent owner's declaration of how the agent operates: what it is for and which team answers for it, how it runs and on whose behalf, the systems it reaches and the data it handles there, which actions need a person, and what it must never do.

A profile serves two purposes. Reviewers judge an agent against the profile pinned to its [assessment](./agent-assessments.mdx#pinning-an-operating-profile), and a program's controls can say which agents they are meant for by what their profile declares. Once a certification names the profile, the Agent Gateway refuses requests that do what the profile rules out.

Every save is an immutable version, identified by its CID, so an assessment and a certification name exactly the version they judged. The agent has one current version at a time.

The **Operating Profile** page appears on each agent when agent certification is turned on for your deployment. Organization Owners and the agent's operators can design and save its profile; users bound to the agent as viewers can read it.

Key actions associated with operating profiles include:

- [Designing a profile](#designing-a-profile)
- [Checking a profile against activity](#checking-a-profile-against-activity)
- [Managing versions](#managing-versions)
- [Using a profile in certification](#using-a-profile-in-certification)

## Designing a profile

To design an agent's first profile:

1. Select **Agents** in the sidebar, then the agent
2. On the agent's **Operating Profile** page, select **Design Profile** at the top. On its **Overview**, select **Actions**, then **Design Profile**.
3. Under **Getting Started**, choose where to start:
   - **Start From Activity**: Guardian groups what it saw the agent use over the last 30 days into systems for you to confirm. When the agent's activity can't be read, **Start Fresh** takes its place, starting from an empty profile where you add what the agent reaches by name.
   - **Edit Version** _n_: the agent's current profile, when it has one, saved as a new version
   - **Copy Another Agent's Profile**: the profile of another active agent that has one, such as one shared across a fleet
4. Complete the **About**, **Systems** and **Limits** steps, selecting **Continue** after each
5. On **Review**, resolve anything it lists, then select **Save Profile**

To change an agent's profile, select **Edit Profile** at the top of its **Operating Profile** page, or **Actions**, then **Edit Profile**, on its **Overview**. When the agent has a profile, the designer skips **Getting Started** and opens the current version at **Review**; go back to **About**, **Systems** or **Limits** to make your changes, then select **Save Profile**.

The saved version becomes the agent's current profile.

### About

What the agent is for and who it serves:

- **What is it for?**: a sentence or two on the agent's purpose
- **Which team answers for it?**: the team reviewers and auditors go to with questions
- **Who starts it?**: a person, each session, or it runs on its own
- **Whose access does it use?**: the person using it, or its own credentials
- **Who uses it?**: your staff, customers or the public, or both

### Systems

A system is a service the agent reaches, such as GitHub or your ticketing tool. Each system lists what makes it up, as rules of four kinds:

| Kind           | Matches                                       | Example                              |
| -------------- | --------------------------------------------- | ------------------------------------ |
| **Tool**       | A tool the agent is offered or calls          | `tool:Read`                          |
| **MCP server** | Every tool an MCP server provides             | `mcp:billing`                        |
| **Host**       | A host the agent's traffic reaches            | `host:*.billing.example.com`         |
| **Permission** | A permission in the agent's captured settings | `permission:claude:Bash(npm test:*)` |

A `*` matches any run of characters. For each system, say what the agent may do there (**Read**, **Write**, **Execute**) and the kinds of data it handles there, such as **Personal data** or **Credentials and secrets**. When you start from activity, anything Guardian saw but couldn't place in a system is listed for you to add to one. An agent that reaches nothing needs no systems.

### Limits

Within its systems, the agent may do everything not listed here on its own.

- **Actions That May Need a Person**: tools whose names suggest a call can cause harm, such as moving money or changing production. Mark each **On its own**, **Needs a person** (a person **Approves each call** or **Reviews the result**, with an optional note on where), or **Never**. Select **Add Action** for any other action a person should oversee.
- **It Must Never**: what the agent must never do, even with someone's approval, such as "Execute payments". Select **Add Exclusion** to pick a suggestion, which follows the kinds of data its systems handle, or to write your own. Optionally link each to the tools, MCP servers or hosts that would show it happening.

### Review

**Review** lists anything the profile still needs, and anything Guardian can't accept, such as a value that looks like a credential. A profile with no changes from the current version adds no version.

## Checking a profile against activity

From the **Systems** step on, the designer checks the profile against what the agent was seen with over the last 30 days: the tools it was offered and called, the MCP servers it had configured, the hosts it reached, and the permissions in its captured configuration. The agent's **Operating Profile** page shows the same check for the current version, under **Checked Against Activity**.

The check groups what it finds:

| Finding                              | Meaning                                                                                                |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------ |
| **Seen Doing What It Must Never Do** | The profile rules these out, and the agent was seen with them. This is a breach, not a gap to declare. |
| **Not in a System Yet**              | The agent was seen with these, and no system includes them. Add them to a system, or rule them out.    |
| **In the Profile but Not Seen**      | Nothing in the window matched these. That's fine for tools it rarely needs.                            |
| **Available but Never Used**         | Its app offers these, but the agent never called them. They stay out unless you add them.              |

The check also says what it couldn't see, such as tools run over stdio, hosts reached without the gateway, or Claude Code's ask and deny rules, which aren't captured.

## Managing versions

The **Version History** on the agent's **Operating Profile** page lists every version with its CID, when it was saved, and who saved it. Select **View** to read a version, or **Make Current** to make an earlier version the agent's profile again without editing it.

Changing the current profile of a certified agent matters: a certification names one profile version, so the gateway stops admitting the agent wherever a certification is required until it holds that version again. To recover, select **Make Current** on the certified version, or certify the new one.

## Using a profile in certification

- **In a program**, a control can be judged against profile sections (**Purpose**, **Context**, **Systems**, **Excluded**), and its **Applies To** tells owners and reviewers which agents it is meant for, such as agents that handle personal data. See [Governance Programs](./governance-programs.mdx#controls).
- **In an assessment**, the owner pins a profile version. Reviewers judge the agent against it, and the submission freezes the check of the profile against the agent's activity for them. Pinning a profile is optional. See [Agent Assessments](./agent-assessments.mdx#pinning-an-operating-profile).
- **At the gateway**, a certification that names a profile holds the agent to it: a request that offers a tool or MCP server, or reaches a host, that the profile excludes, under **It Must Never** or as an action marked **Never**, is refused. A request the gateway can't check against the certified profile is refused too: `agent_certification_host_unverifiable`, `agent_certification_tools_unreadable`, `agent_certification_profile_unavailable` and `agent_certification_profile_unreadable` say why. Tools the profile doesn't declare, permission rules, and actions that need a person aren't refused; the check reports them instead. See [Agent Certifications](./agent-certifications.mdx#operating-profile-enforcement).

## Related

- [Agent Assessments](./agent-assessments.mdx) — pin a profile version for reviewers to judge
- [Agent Certifications](./agent-certifications.mdx) — how the gateway holds a certified agent to its profile
- [Governance Programs](./governance-programs.mdx) — controls that judge, or apply by, the profile
- [Agent Configuration](./agent-configuration.mdx) — the captured configuration the check reads permissions from
- [Agent Inventory](./agent-inventory.mdx) — open an agent and its pages