Operating Profiles
Declare what an agent is for, the systems it reaches, and what it must never do, check the declaration against what the agent was seen doing, and save it as a version.
About operating profiles
An operating profile is an agent owner’s declaration of how the agent operates: what it is for and which team answers for it, how it runs and on whose behalf, the systems it reaches and the data it handles there, which actions need a person, and what it must never do.
A profile serves two purposes. Reviewers judge an agent against the profile pinned to its assessment, and a program’s controls can say which agents they are meant for by what their profile declares. Once a certification names the profile, the Agent Gateway refuses requests that do what the profile rules out.
Every save is an immutable version, identified by its CID, so an assessment and a certification name exactly the version they judged. The agent has one current version at a time.
The Operating Profile page appears on each agent when agent certification is turned on for your deployment. Organization Owners and the agent’s operators can design and save its profile; users bound to the agent as viewers can read it.
Key actions associated with operating profiles include:
- Designing a profile
- Checking a profile against activity
- Managing versions
- Using a profile in certification
Designing a profile
To design an agent’s first profile:
- Select Agents in the sidebar, then the agent
- On the agent’s Operating Profile page, select Design Profile at the top. On its Overview, select Actions, then Design Profile.
- Under Getting Started, choose where to start:
- Start From Activity: Guardian groups what it saw the agent use over the last 30 days into systems for you to confirm. When the agent’s activity can’t be read, Start Fresh takes its place, starting from an empty profile where you add what the agent reaches by name.
- Edit Version n: the agent’s current profile, when it has one, saved as a new version
- Copy Another Agent’s Profile: the profile of another active agent that has one, such as one shared across a fleet
- Complete the About, Systems and Limits steps, selecting Continue after each
- On Review, resolve anything it lists, then select Save Profile
To change an agent’s profile, select Edit Profile at the top of its Operating Profile page, or Actions, then Edit Profile, on its Overview. When the agent has a profile, the designer skips Getting Started and opens the current version at Review; go back to About, Systems or Limits to make your changes, then select Save Profile.
The saved version becomes the agent’s current profile.
About
What the agent is for and who it serves:
- What is it for?: a sentence or two on the agent’s purpose
- Which team answers for it?: the team reviewers and auditors go to with questions
- Who starts it?: a person, each session, or it runs on its own
- Whose access does it use?: the person using it, or its own credentials
- Who uses it?: your staff, customers or the public, or both
Systems
A system is a service the agent reaches, such as GitHub or your ticketing tool. Each system lists what makes it up, as rules of four kinds:
| Kind | Matches | Example |
|---|---|---|
| Tool | A tool the agent is offered or calls | tool:Read |
| MCP server | Every tool an MCP server provides | mcp:billing |
| Host | A host the agent’s traffic reaches | host:*.billing.example.com |
| Permission | A permission in the agent’s captured settings | permission:claude:Bash(npm test:*) |
A * matches any run of characters. For each system, say what the agent may do there (Read, Write, Execute) and the kinds of data it handles there, such as Personal data or Credentials and secrets. When you start from activity, anything Guardian saw but couldn’t place in a system is listed for you to add to one. An agent that reaches nothing needs no systems.
Limits
Within its systems, the agent may do everything not listed here on its own.
- Actions That May Need a Person: tools whose names suggest a call can cause harm, such as moving money or changing production. Mark each On its own, Needs a person (a person Approves each call or Reviews the result, with an optional note on where), or Never. Select Add Action for any other action a person should oversee.
- It Must Never: what the agent must never do, even with someone’s approval, such as “Execute payments”. Select Add Exclusion to pick a suggestion, which follows the kinds of data its systems handle, or to write your own. Optionally link each to the tools, MCP servers or hosts that would show it happening.
Review
Review lists anything the profile still needs, and anything Guardian can’t accept, such as a value that looks like a credential. A profile with no changes from the current version adds no version.
Checking a profile against activity
From the Systems step on, the designer checks the profile against what the agent was seen with over the last 30 days: the tools it was offered and called, the MCP servers it had configured, the hosts it reached, and the permissions in its captured configuration. The agent’s Operating Profile page shows the same check for the current version, under Checked Against Activity.
The check groups what it finds:
| Finding | Meaning |
|---|---|
| Seen Doing What It Must Never Do | The profile rules these out, and the agent was seen with them. This is a breach, not a gap to declare. |
| Not in a System Yet | The agent was seen with these, and no system includes them. Add them to a system, or rule them out. |
| In the Profile but Not Seen | Nothing in the window matched these. That’s fine for tools it rarely needs. |
| Available but Never Used | Its app offers these, but the agent never called them. They stay out unless you add them. |
The check also says what it couldn’t see, such as tools run over stdio, hosts reached without the gateway, or Claude Code’s ask and deny rules, which aren’t captured.
Managing versions
The Version History on the agent’s Operating Profile page lists every version with its CID, when it was saved, and who saved it. Select View to read a version, or Make Current to make an earlier version the agent’s profile again without editing it.
Changing the current profile of a certified agent matters: a certification names one profile version, so the gateway stops admitting the agent wherever a certification is required until it holds that version again. To recover, select Make Current on the certified version, or certify the new one.
Using a profile in certification
- In a program, a control can be judged against profile sections (Purpose, Context, Systems, Excluded), and its Applies To tells owners and reviewers which agents it is meant for, such as agents that handle personal data. See Governance Programs.
- In an assessment, the owner pins a profile version. Reviewers judge the agent against it, and the submission freezes the check of the profile against the agent’s activity for them. Pinning a profile is optional. See Agent Assessments.
- At the gateway, a certification that names a profile holds the agent to it: a request that offers a tool or MCP server, or reaches a host, that the profile excludes, under It Must Never or as an action marked Never, is refused. A request the gateway can’t check against the certified profile is refused too:
agent_certification_host_unverifiable,agent_certification_tools_unreadable,agent_certification_profile_unavailableandagent_certification_profile_unreadablesay why. Tools the profile doesn’t declare, permission rules, and actions that need a person aren’t refused; the check reports them instead. See Agent Certifications.
Related
- Agent Assessments — pin a profile version for reviewers to judge
- Agent Certifications — how the gateway holds a certified agent to its profile
- Governance Programs — controls that judge, or apply by, the profile
- Agent Configuration — the captured configuration the check reads permissions from
- Agent Inventory — open an agent and its pages