Declare your agent subscriptions

Use Settings › General › Agent Subscriptions to declare the subscriptions your company pays for, so the agents that work on them read Sanctioned and the others read Shadow. You need the admin role or higher; the page is not shown to editors and viewers. For what the two statuses mean, read Sanctioned and Shadow agents.

Until you declare a subscription, every agent reads Shadow and no Shadow alert is sent.

Declare a subscription

1. Choose Add subscription.
2. Choose the Kind, such as Anthropic org, ChatGPT workspace or Cursor team.
3. Choose the Subscription ID from the IDs your agents report for that kind, with the number of agents on each and when it was last seen, or type one. A typed ID is checked against the kind’s format before it is saved.
4. Give it a Label of up to 80 characters, such as “Acme engineering Claude org”. The label is what the agent header and the budget show.
5. Under Allowed org units, choose Whole organization, or Selected org units and pick at least one unit. A unit covers every unit below it.
6. Optionally, set a Default monthly budget per agent, then choose Save.

The subscription ID is an organization, team or account identifier, never an API key or token: every role sees it on the agent page, and the audit trail keeps it. An ID no agent reports yet is saved and marked Not observed yet.

Each kind and subscription ID can be declared once. You can declare several subscriptions of the same kind, and the same ID under two kinds is two declarations. An organization holds at most 500 declarations, and each declaration at most 200 org units.

Subscription ID formats

Kind	Format
Anthropic org · ChatGPT workspace	A UUID
Azure OpenAI resource	A hostname only, with no scheme, port or path
Gateway	A hostname only. A model provider’s own API host is refused
GitHub enterprise	The enterprise slug, or its hostname ending in .ghe.com
GitHub org	The organization slug: letters, digits and single hyphens, up to 39 characters
GCP project	The project ID: 6 to 30 characters, starting with a lower-case letter
AWS account	The 12-digit account ID
Cursor team	The team ID, as the Cursor admin console shows it
Cline org	The organization ID: letters, digits, hyphens and underscores, up to 128 characters

Letter case does not matter, except for Cursor team and Cline org IDs, which must match exactly. GitHub enterprise and GitHub org are reserved for GitHub Copilot, which is not yet supported, so no agent reports them yet.

Edit or delete a declaration

Open a declaration’s actions to edit or delete it. You can change its label, its allowed org units and its default budget; its kind and subscription ID cannot change, so to change them, delete the declaration and add it again. To delete several, select them in the table and choose Delete.

Change	Effect on agents
Add a declaration, or allow more org units	The agents on it read Sanctioned at once, with no alert. Your first declaration also checks every agent and sends one notification counting the Shadow agents
Delete a declaration, or allow fewer org units	The agents it no longer covers read Shadow at once, and one notification counts those not alerted in the last 24 hours
Change only the label or the default budget	No agent changes status

Every declaration you add, edit or delete is recorded in the audit trail, and appears in its export.

When an org unit of a declaration is deleted, the table marks it Deleted org unit and the declaration keeps it: the unit matches no agent, and a perimeter is never widened to the whole organization by a deletion. When every unit of a declaration is deleted, the page warns that it matches no agent until you edit its allowed org units. You can remove a deleted unit from the declaration when you edit it.

Set default budgets

The organization’s default monthly budget is set in the Agent Budgets section of this page. An agent uses its own budget first, then the default of the official subscription it is Sanctioned on, then the organization default:

Agent	Budget it uses
Has its own budget	Its own budget
No budget of its own, Sanctioned on a subscription with a default	That subscription’s default, shown as “Default of” and the subscription’s label
No budget of its own, Shadow, or Sanctioned on a subscription with no default	The organization default, if one is set

Each default applies to each agent separately: a default of $500 gives each agent $500 a month, not $500 shared. Clearing a default never overwrites a budget someone set on an agent. An agent’s own budget is set from its Economics tab; see Track an agent’s spend.

Read an agent’s status

Open an agent: its header shows Sanctioned or Shadow with its reason, such as Shadow · Subscription not official. Hover or focus the status for its details, such as the subscription the agent reported last and when it was observed. For a subscription not declared, an admin also reads where to declare it. Every role can read the status.

What you read	What to do
Shadow · Subscription not official	If the subscription is one your company pays for, declare it. Otherwise, ask the agent’s owner to move to an official subscription
Shadow · Org unit not allowed	Allow the subscription for the owner’s org unit, or check the agent’s owner on its Identity tab
Shadow · User can’t be placed	Place the owner in an org unit, or allow the subscription for the whole organization
Shadow · Subscription can’t be determined	The agent reports no subscription, for example on a raw API key. No declaration changes it

Limits

• A raw API key reveals no organization, so an agent using one reads Subscription can’t be determined.
• A shared gateway hostname identifies no company, and a Gateway declaration covers only Claude Code, Codex CLI and Cline agents.
• Identity signal collection is not needed: the comparison uses the subscription identifier, never an email address.
• Sanctioned means the agent reports an official subscription, not that its account is verified.
• Only agents on hosts running the client are classified.

To choose which channels receive the Shadow agent detected notification, see Set up notification channels.