The Swif Agentic Security Logging Policy enables or disables audit logging for supported AI-agent activity on managed devices.

When logging is enabled, the Swif Agentic Security agent can report supported agent actions to Swif so administrators can review activity, investigate risky behavior, and maintain an audit record. Reported activity can be viewed from the device's Agentic Security area in Swif.

The policy supports:

Important: This policy controls logging. It does not install the Swif Agentic Security agent. Install the agent on the target devices before assigning the logging policy.

The policy contains one configurable setting: Enabled.

When enabled, the policy turns on Agentic Security audit logging on assigned devices. Depending on the supported AI agent and integration, administrators can use the resulting activity records to:

Swif's Agentic Security documentation also describes automatic redaction of detected API keys, passwords, and credentials before they appear in logs. Redaction reduces exposure, but administrators should still treat activity records as potentially sensitive security data.

For Agentic Security installation and supported platforms, see Getting Started with Swif's Agentic Security for Enterprise.

For organization-managed devices that use supported AI agents, set:

Start with a small pilot group. Generate controlled AI-agent activity, confirm that expected events appear, and review the information visible to administrators before expanding the assignment.

For BYOD deployments, document the monitoring purpose, scope, and retention practices for device users. Confirm that your organization has provided any notice or obtained any authorization required by applicable law and internal policy.

Controls whether Swif Agentic Security logging is active.

The setting is optional and has no preset policy default. If your goal is to collect Agentic Security activity, explicitly select Enabled instead of leaving the field unset.

This policy does not provide settings for:

Use the applicable Agentic Security or OpenClaw policies for controls that are outside this logging policy.

Assigning policies to device groups is recommended when new devices should automatically inherit the same logging configuration. For the general assignment workflow, see Assigning policies to devices or groups.

After deployment:

Use a harmless test action, such as reading a temporary test file. Do not test logging by deleting production data, changing security controls, or exposing credentials.

Note: A successful policy status confirms that Swif delivered the configuration. It does not by itself confirm that the Agentic Security agent is running or that a supported AI agent has generated an event. Verify both policy status and actual test activity.

Agentic Security logs may reveal information about developer activity, commands, files, tools, repositories, and security-relevant events. Treat these records as sensitive organizational data.

Before broad deployment:

Logging provides visibility and audit evidence. It does not automatically block a risky action or reverse a change performed by an AI agent.

The logging policy provides the activity record used for monitoring and investigation. Other Agentic Security policies may manage different parts of an agent's configuration or permissions.

For example, the Swif OpenClaw Config Tools Policy can manage supported OpenClaw configuration and tool-use controls. Assigning an OpenClaw policy does not replace the need to enable logging when administrators require an audit trail.

Avoid assigning conflicting Agentic Security logging policies to the same device. If one policy enables logging and another disables it, the resulting state can depend on which configuration is applied most recently.

Check the following:

Generate a new, harmless test action after confirming these items.

The Agentic Security activity view can identify devices that do not have a logging policy assigned. Select the available Create/Assign action for the logging policy, or create the policy through Policy Management and assign it to the affected device or group.

Confirm that the assigned policy has Enabled explicitly selected.

The logging policy does not install the Agentic Security agent.

Use Swif's Agentic Security setup workflow to deploy the appropriate platform-specific agent:

After installation, return to the logging policy and verify the assignment.

An offline device cannot receive a new policy or report new activity to Swif in real time. Restore network access, allow the device and Agentic Security agent to reconnect, and then generate a new test event.

Do not assume that every action performed while the device was offline will appear later. Verify the behavior using the installed agent version and your deployment configuration.

Compare:

Test each device with the same supported AI-agent action to isolate the difference.

Swif is designed to detect and redact supported secrets, but no automated redaction system should be treated as complete.

If sensitive information appears:

To explicitly stop Agentic Security logging on assigned devices:

Disabling logging does not automatically uninstall the Agentic Security agent or delete activity that was collected previously. Use the separate Agentic Security removal workflow if the agent must also be removed.

Removing the policy assignment is not the same as explicitly disabling logging. If logging must be turned off, deploy Disabled first and verify the change before removing the assignment.

The Swif Agentic Security Logging Policy provides a single organization-managed control for enabling or disabling AI-agent audit logging on macOS, Windows, and Linux devices.

For a reliable deployment: