> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/policies/policy-types/agentic-privilege-elevation-policy.md).

# Agentic Privilege Elevation Policy

<figure><img src="/files/T7ncw31LWyK6RnpPqlbM" alt=""><figcaption></figcaption></figure>

## Agentic Privilege Elevation

### Overview

The Agentic Privilege Elevation policy governs **elevation requests made by an AI agent**. Where a standard Privilege Elevation policy manages requests for administrative elevation initiated by a human user, an Agentic Privilege Elevation policy applies the same enforcement model to elevation requested *by an agent* — treating the AI agent as a first-class principal subject to the same allow, deny, and approval controls that already govern human users.

AI agents routinely attempt operations that require administrative rights — installing software, modifying protected configuration, running privileged tooling — on behalf of the user who launched them. Rather than letting an agent inherit and silently exercise the user's privileges, an Agentic Privilege Elevation policy inserts a decision point at the moment the agent requests elevation. The request can be allowed, denied, held for administrator approval, held for end-user (human-in-the-loop) approval, or gated behind MFA or justification — and every elevation request is audited against the policy baseline.

While Agentic Privilege Elevation policies enforce controls actively, they are designed to be introduced in Monitor mode first. Observing which elevation requests an agent would make — before the policy enforces — lets you tune scope and risk thresholds without interrupting legitimate agent activity. See [Policy: Phased Rollout Planning](/en/keeperpam/endpoint-privilege-manager/setup/policy-phased-rollout-planning.md) for recommended sequencing.

### How it Works

**Targeting agent elevation, not user elevation.** In addition to the standard User, Machine, and Application collection filters, an Agentic Privilege Elevation policy is scoped to an Agentic AI Collection — a group of known and flagged AI agent applications. The policy evaluates elevation requests that originate from a matching agent process, distinct from elevation requested directly by the human user. Agents are detected either by signature (Known Agents) or by behavioral heuristics (Possible Agents), and any application can be flagged as Agentic AI from the Applications view.

**Risk-score-driven controls.** Policy controls can be conditioned on a risk threshold. When an agent's elevation request exceeds a configured threshold — for example, **Likelihood of Being an AI Agent (%)** — the policy's response action is triggered. This lets you, for instance, allow elevation for low-confidence detections silently while requiring approval for any request scoring above a defined tier.

**Human-in-the-loop.** The **Require User Approval** control prompts the end user on the endpoint to approve or deny the agent's elevation request in real time. This is distinct from administrator approval: it puts the human operating the endpoint in the loop for the agent's elevation. A *Don't ask again for N hours* option is available to reduce repeat prompts.

**Stacked controls.** Controls are additive. When more than one applicable control is set (for example MFA and approval), all enforced requirements must be satisfied before the elevation request proceeds.

**Audit baseline.** Every governed elevation request — allowed, denied, or held — is recorded, so all AI agent elevation activity can be audited against the policy baseline regardless of the enforcement outcome.

### Controls

An Agentic Privilege Elevation policy supports the following controls:

**Auto-Approve (Allow)** — Permits matching agent elevation requests without further friction. Cannot be combined with other controls.

**Auto-Deny (Deny)** — Blocks matching agent elevation requests and returns a deny outcome without a user-facing prompt. Cannot be combined with other controls.

**Require Approval** — The elevation request is held until an assigned approver grants it.

**Require Justification** — A written reason must be supplied before the elevation proceeds.

**Require MFA** — Identity must be verified (TOTP) before the elevation proceeds.

**Require User Approval** — The end user on the endpoint must approve or deny the agent's elevation request (human-in-the-loop).

### Managing an Agentic Privilege Elevation Policy

{% stepper %}
{% step %}

#### Define an Agentic AI Collection

Before creating the policy, unless you plan to use the "All Agentic AI" collection, you will need to organize the Agentic AI Agents you want to govern into an **Agentic AI Collection**. Navigate to **Collections → Agentic AI** and create a new collection. Add known agents directly, or flag detected applications as Agentic AI from the **Applications** view — flagged applications then appear under the Agentic AI collection and become available for policy targeting.

{% hint style="info" %}
Give the collection a descriptive name that reflects its purpose — for example, "Approved Coding Assistants" or "Flagged Possible Agents" — to make it easy to identify when assigning it to a policy.
{% endhint %}
{% endstep %}

{% step %}

### Open the Policy Form

From the **Admin Console**, navigate to **Endpoint Privilege Manager → Policies** and click the **Create Policy** button. <img src="/files/6NnfrxrQKQdCeUxuSpWf" alt="" data-size="line">
{% endstep %}

{% step %}

#### Configure the Policy

Fill in the policy details:

* **Policy Name** — A descriptive name (e.g. *Agentic Privilege Elevation – Approval for High-Likelihood Agents*)
* **Policy Type** — Select **Agentic Privilege Elevation**
* **Status** — Select **Monitor** to observe matches first, or **Enforce** to apply controls actively

<figure><img src="/files/JXt2u5oMbJYI64nJzcje" alt="" width="262"><figcaption></figcaption></figure>

{% hint style="info" %}
Agentic Privilege Elevation policies default to Monitor mode and support the full Monitor / Monitor & Notify / Enforce / Off lifecycle. Start in Monitor to validate scope before enforcing.
{% endhint %}
{% endstep %}

{% step %}

#### Select Controls

<figure><img src="/files/mu1gkAjy0U2C1FIh3D8y" alt="" width="327"><figcaption></figcaption></figure>

Add the control(s) to apply when a matching agent elevation request is detected — **Require Approval**, **Require Justification**, **Require MFA**, or **Require User Approval**. Optionally configure a **Risk Score** threshold so that controls only trigger when the agent's likelihood or risk score exceeds the configured value.

**Stacked Controls** — When controls are stacked, all must be satisfied before the elevation is permitted. **Allow** and **Deny** are mutually exclusive and cannot be combined with any other control.

<figure><img src="/files/uQFZt0R1xYG6vckfMYb5" alt="" width="328"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Set Policy Filters

Define the scope of the policy:

* **User Collections** — Target specific User Collections, or select all users
* **Machine Collections** — Target specific Machine Collections, or select all enrolled endpoints
* **Application Collections** — Optionally scope to specific applications
* **Agentic AI Collections** — Select the Agentic AI Collection created in [Step 1](#define-an-agentic-ai-collection)

<figure><img src="/files/9qgYgEJhTkglsRCS2pir" alt="" width="261"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

#### Save and Deploy

Click **Save**. The policy is pushed to in-scope endpoints within approximately 30 minutes, or immediately via the **Refresh Policies** option in the Keeper agent.
{% endstep %}
{% endstepper %}

### Admin Console UI

The Agentic Privilege Elevation policy form exposes the following elements:

* Policy Name
* Policy Type (Agentic Privilege Elevation selected)
* Status
* Controls
* User Collections
* Machine Collections
* Application Collections
* Agentic AI Collections

### Policy JSON Example

The following Agentic Privilege Elevation policy runs in Enforce mode and requires operator approval for any elevation request from an application detected as an AI agent with a likelihood score of 90% or higher, evaluating all sub-processes, scoped to all users, all applications, and a single Machine Collection.

```json
{
  "PolicyName": "-->  5-Agentic-PrivilegeElevation",
  "PolicyType": "AgenticPrivilegeElevation",
  "PolicyId": "nsG8i4i25pEaryXKgVHTpg",
  "Status": "enforce",
  "Actions": {
    "OnSuccess": { "Controls": ["OPERATORAPPROVAL"] },
    "OnFailure": { "Command": "" }
  },
  "NotificationMessage": "A policy has been set to monitor mode.  When this policy is enabled, [mfa, justification, request] will be required to run this process as an administrator.",
  "NotificationRequiresAcknowledge": false,
  "RiskLevel": 50,
  "Operator": "And",
  "Rules": [
    {
      "RuleName": "UserCheck",
      "ErrorMessage": "This user is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckUser()"
    },
    {
      "RuleName": "MachineCheck",
      "ErrorMessage": "This Machine is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckMachine()"
    },
    {
      "RuleName": "ApplicationCheck",
      "ErrorMessage": "This application is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckFile(false)"
    },
    {
      "RuleName": "DateCheck",
      "ErrorMessage": "Current date is not covered by this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckDate()"
    },
    {
      "RuleName": "TimeCheck",
      "ErrorMessage": "Current time is not covered by this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckTime()"
    },
    {
      "RuleName": "DayCheck",
      "ErrorMessage": "Today is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckDay()"
    },
    {
      "RuleName": "CertificateCheck",
      "ErrorMessage": "Certificate hash is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckCertificate()"
    }
  ],
  "UserCheck": ["*"],
  "MachineCheck": ["aDdMC3y_isged8ODDSnvRg"],
  "ApplicationCheck": ["*"],
  "DayCheck": [],
  "DateCheck": [],
  "TimeCheck": [],
  "CertificationCheck": [],
  "Extension": {
    "SubProcessCheck": ["*"],
    "minAiLikelihoodPercent": 90
  }
}
```

### Field Reference

<table><thead><tr><th width="298.3636474609375">Field</th><th>Description</th></tr></thead><tbody><tr><td><code>PolicyName</code></td><td>Display name of the policy.</td></tr><tr><td><code>PolicyType</code></td><td>Policy type identifier. For this policy type, <code>AgenticPrivilegeElevation</code>.</td></tr><tr><td><code>PolicyId</code></td><td>Unique identifier assigned to the policy.</td></tr><tr><td><code>Status</code></td><td>Policy lifecycle state — <code>monitor</code>, <code>monitor &#x26; notify</code>, <code>enforce</code>, or <code>off</code>. Agentic Privilege Elevation policies default to <code>monitor</code>.</td></tr><tr><td><code>Actions.OnSuccess.Controls</code></td><td>The control(s) applied when the policy matches — for example <code>OPERATORAPPROVAL</code>, <code>ALLOW</code>, <code>DENY</code>, <code>JUSTIFY</code>, <code>MFA</code>, <code>REQUEST</code>. Multiple controls are additive (stacked); <code>ALLOW</code> and <code>DENY</code> cannot be combined with other controls.</td></tr><tr><td><code>Actions.OnFailure.Command</code></td><td>The action taken when a rule check fails. Empty (<code>""</code>) where the policy does not enforce a deny on failure.</td></tr><tr><td><code>NotificationMessage</code></td><td>Message surfaced to the end user when the policy applies.</td></tr><tr><td><code>NotificationRequiresAcknowledge</code></td><td>Whether the end user must acknowledge the notification before proceeding.</td></tr><tr><td><code>Operator</code></td><td>Logical operator combining the rule checks. <code>And</code> requires all rules to pass.</td></tr><tr><td><code>Rules</code></td><td>The ordered set of built-in rule checks evaluated for a match (user, machine, application, date, time, day, certificate).</td></tr><tr><td><code>Rules[].RuleName</code></td><td>Identifier of the individual rule check.</td></tr><tr><td><code>Rules[].ErrorMessage</code></td><td>Message recorded when the rule check does not pass.</td></tr><tr><td><code>Rules[].RuleExpressionType</code></td><td>Type of the rule expression. <code>BuiltInAction</code> for the standard checks.</td></tr><tr><td><code>Rules[].Expression</code></td><td>The built-in function evaluated for the rule (e.g. <code>CheckUser()</code>, <code>CheckMachine()</code>, <code>CheckFile(false)</code>).</td></tr><tr><td><code>UserCheck</code></td><td>User Collection scope. <code>["*"]</code> targets all users.</td></tr><tr><td><code>MachineCheck</code></td><td>Machine Collection scope. A collection identifier targets specific enrolled endpoints; <code>["*"]</code> targets all.</td></tr><tr><td><code>ApplicationCheck</code></td><td>Application Collection scope. <code>["*"]</code> targets all applications.</td></tr><tr><td><code>DayCheck</code> / <code>DateCheck</code> / <code>TimeCheck</code></td><td>Optional day-, date-, and time-of-day constraints on when the policy applies. Empty arrays apply no constraint.</td></tr><tr><td><code>Extension.SubProcessCheck</code></td><td>Scopes which sub-processes spawned by the agent the policy evaluates. Accepts a collection of specific applications (for example <code>cmd.exe</code>, <code>powershell.exe</code>) or <code>["*"]</code> to evaluate all sub-processes.</td></tr><tr><td><code>Extension.minAiLikelihoodPercent</code></td><td>The minimum AI-likelihood detection score (0–100) a process must reach for the policy to apply. In the example, the policy applies only to processes scoring 90% or higher.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/policies/policy-types/agentic-privilege-elevation-policy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.