Skip to main content

What the person using an agent sees

This page is for someone who uses an AI agent, such as Claude Code, that your organization connects through PolicyArc. It describes the three moments where PolicyArc shows up and what to do when the agent cannot reach something.

Signing in​

The first time your agent connects, it opens your browser. You sign in at your organization's usual sign-in page, and the browser hands control back to the agent. From then on the agent acts as you. PolicyArc records the calls it checks with your user ID and the agent's client ID.

Your administrator decides which sign-in page you see. Connect clients has the steps for each agent.

Approving a request​

A tool call through the managed gateway, such as one Claude Code makes, never waits for approval. Policy allows it or refuses it at once.

Approval applies to an agent that asks PolicyArc for a token directly, when a rule your administrator wrote holds that request, such as a write to a shared report. The approver might be you or someone else your administrator named. The approver gets a message from your organization's approval service, for example a notification on their phone. It says what the agent wants, such as Allow the agent to write /reports/q3.txt.

Approve only what you expect. If you did not start the task, or the message names something you do not recognize, refuse it. Until someone decides, the agent waits. If the request is refused, the agent gets access_denied. If no one answers in time, it gets expired_token. Either way it gets no access, and what it tells you depends on the agent.

When the agent is refused​

When policy refuses a call, the agent receives an error. What you see depends on the agent. Through the managed gateway, a refused tool call comes back as the text HTTP 403: Access denied, with no reason. A refusal at a token request, or before you reach the sign-in page, also comes back as Access denied (sometimes Request denied), with no reason. Only a refusal decided after you have signed in carries the reason policy gave, such as all_resources_denied, in error_description, and the agent may or may not show it to you.

Asking for access​

Your administrator can find the refusal and the reason for it. Tell them these things.

  • The agent's name, as it appears in its connection settings.
  • What you asked the agent to do, and the tool or file involved.
  • Roughly when it happened.

Administrators search the audit log by client and time. A refusal's row holds the reason policy recorded.