Running Enforcement Actions

The AI Agent can trigger enforcement actions and manage enforcement schedules from the chat. Before taking any action, the agent shows a detailed preview of the enforcement — including its name, what actions it will run, and any conditions it applies — and waits for your explicit confirmation.

Enforcement runs initiated through the agent are real: they execute on the current live data in your environment and may send data or take actions outside Axonius (for example, creating a ticket in an external system or sending a notification).

Required Permissions

Running enforcements through the AI Agent requires:

• The Enforcements permissions needed to view and run enforcement sets in Axonius
• The AI Agents write operations capability enabled for your role

Manually Running an Enforcement

To trigger an enforcement action immediately, ask the agent to run it by name:

• "Run the 'Patch Windows Devices' enforcement."
• "Trigger the 'Create Jira Ticket for Unmanaged Devices' enforcement now."

The agent finds the matching enforcement set and shows you a preview before running it. The preview includes:

• The enforcement set name
• The actions configured in the set (what it will do)
• Whether the enforcement has conditions configured (conditions are ignored for manual runs — the enforcement runs against all assets that match its trigger query)
• A note if the enforcement involves actions that leave Axonius, such as creating a ticket or sending a notification

If an enforcement run is already in progress for the set you requested, the agent will tell you and will not run it again until the current run completes.

Event-triggered enforcements and enforcements with no configured trigger cannot be run manually through the agent. For those, use the Axonius Enforcement Center.

To run the enforcement, confirm when prompted. The agent submits the run and reports the outcome.

Pausing and Resuming a Scheduled Enforcement

To pause or resume the automatic schedule of an enforcement set, ask the agent:

• "Pause the schedule for the 'Daily CVE Report' enforcement."
• "Resume the 'Patch Compliance' enforcement schedule."

The agent shows you the current scheduling state of the enforcement before making any change, then waits for your confirmation. After you confirm, it applies the change and reports the new state.

Pausing a schedule stops the enforcement from running automatically at its configured interval. It does not affect any run already in progress. Resuming re-enables the automatic schedule; the enforcement will next run at its next scheduled time.

Viewing Enforcement Results

After a manual run, the agent reports whether the run completed successfully. For detailed results — including which assets were affected and whether individual actions succeeded — navigate to the enforcement set's task history in the Axonius Enforcement Center.