Investigate blocked actions
Review why an action was stopped and decide whether policy, access, or agent behavior should change.
A block is a control working
Blocked actions are not noise. They are moments where policy prevented an agent from crossing a boundary. The investigation should decide whether the block was correct, the policy is too broad, or the agent needs a narrower scope. An LLM trace can help when the block involved a model call.

Investigating the block
Open the blocked action from Operations or audit history and review the agent, tool, destination, policy, and trust context together. Repeated patterns usually matter more than a single isolated block.
Adjust policy only when the business boundary was wrong or incomplete. Adjust connector or agent scope when the agent had more access than it needed.
