Sanctioned and Shadow agents

Every agent on a host running the client reads Sanctioned or Shadow. The status tells you whether the agent works on a subscription your company pays for and has allowed for its owner, so you can see at a glance which agents run on an account you did not choose.

OpenLatch classifies the agents on hosts running the client. Agents on machines without the client are not discovered or classified: discovery of shadow AI across machines without the client is not available.

What the status compares

Each agent reports the subscription its model calls run under: an organization, a workspace, a team, a cloud project or account, or a model gateway. Read a session’s subscription, model and effort lists every kind and where the client reads it. An administrator declares the company’s official subscriptions in Settings › General › Agent Subscriptions, each with the org units it is allowed in; see Declare your agent subscriptions.

OpenLatch compares the two. The comparison uses the subscription identifier alone: no email address and no identity signal takes part, so the status works the same whether identity signal collection is on or off.

The agent is Sanctioned when the subscription it reported last is declared and allowed for its owner’s org unit. Otherwise it is Shadow, with exactly one reason:

Reason	When	Alerts
Subscription not official	The agent reports a subscription that no declaration names	Yes
Org unit not allowed	The subscription is declared, but only for org units that do not hold the agent’s owner	Yes
Subscription can’t be determined	The agent reports no subscription, for example when it uses a raw API key	No
User can’t be placed	The subscription is declared for some org units only, and the agent’s owner sits in none, for example because the owner could not be resolved	No

A declaration allowed for the whole organization makes every agent on that subscription Sanctioned, wherever its owner sits. A declaration limited to org units covers those units and every unit below them.

Where the agent’s org unit comes from

The agent’s org unit is its owner’s unit, as the Identity tab shows it. For an agent that acts for a service, it is the unit of the person accountable for the service, else the unit the service is assigned to. A change to an owner, to a person’s unit or to the org tree changes the status on the next read.

On a machine shared by several people, the client counts one agent per OS user: each OS user’s agent is a separate agent, read from its own owner. People who share one OS account share one agent.

Sanctioned is not verified

The status is derived from the subscription identifier the client reports. OpenLatch does not check that identifier against the provider and does not prove which account an agent uses. Sanctioned means the agent reports an official subscription, never that its account is verified. The status classifies an agent: it never changes a verdict, and it never blocks or pauses an agent.

The status covers a misbehaving agent, not a malicious one: a machine that reports a wrong identifier, by misconfiguration or otherwise, reads as that identifier.

What reads “Subscription can’t be determined”

Situation	Why
The agent uses a raw API key	A key reveals no organization without calling the provider, which OpenLatch never does
OpenCode or Devin	The client reads no subscription for them
A machine on a client older than 0.11.11	Older clients report no subscription
A Cursor agent behind a company gateway	The client reads no gateway setting for Cursor, so it reads its Cursor team, or nothing

A Gateway declaration covers only Claude Code, Codex CLI and Cline agents, the agents for which the client reads a gateway. A gateway hostname shared by many companies, such as a public gateway service, identifies no company: declaring one makes every agent that uses that service Sanctioned.

When the status changes

The status is computed each time you read it. A new declaration, a deleted one or an edited list of org units shows on the next read of every affected agent, with no wait. An agent that switches to another subscription reads the new one: the newest observation wins, and the agent’s header shows when it was observed. Past sessions keep the subscription they recorded.

Alerts

OpenLatch sends the Shadow agent detected notification when an agent becomes Shadow for an alerting reason: Subscription not official or Org unit not allowed. It is in-app for every member, and it reaches each notification channel subscribed to it; see Set up notification channels.

Rule	What it means
No alert before your first declaration	While your organization has declared nothing, nothing is alerted. Your first declaration checks every agent and sends one notification counting the Shadow agents, such as “12 shadow agents discovered”
Only on entering an alerting reason	An agent alerts when it enters Subscription not official or Org unit not allowed, never again while it stays there, and never for Subscription can’t be determined, User can’t be placed or a move to Sanctioned
At most once a day per agent	An agent alerts at most once in 24 hours, whatever the reason
One notification for many agents	A change in Agent Subscriptions, or a check that turns several agents Shadow at once, sends one notification counting them
A wait for new agents	A newly enrolled agent that has not reported a subscription yet is not judged until it reports one, or for 24 hours after it was discovered, whichever comes first

The notification names the agent’s product and the reason, never the person, the machine or the subscription identifier. A notification about one agent opens that agent; one counting several opens the Agents page. Most changes alert within moments; a change OpenLatch could not check at once is caught by an hourly check. The status you read is never delayed.

Budgets

A declaration can carry a default monthly budget for each Sanctioned agent on it. An agent uses its own budget first, then the default of the official subscription it is Sanctioned on, then your organization’s default. A Shadow agent never takes a subscription default. See Track an agent’s spend.