# The admin dashboard

The dashboard is where you see your shadow-AI footprint and decide what to do about it. It's at **useblank.dev/admin**, and access is controlled by role (see [roles](#roles)).

## Overview

The landing view is your fleet at a glance: how much AI use is happening, which tools dominate, and where sensitive data is heading. It reads from a daily rollup, so it stays fast even across millions of events.

## Tools

Every AI tool Blank has seen across your fleet, with how many people and how many devices use each one. Tools Blank doesn't yet recognize show up as **candidates**: real tools your employees are already using that aren't in the catalog yet. From here you review a candidate and sanction, block, or dismiss it.

## Detections

The findings themselves: which detector fired (an AWS key, a credit-card number, a bulk export of personal data), the severity, the tool, and how often. Never the matched text. Drill into a detection to see the pattern behind it and act on false positives, which make the detector quieter over time.

## Extensions

An inventory of the browser extensions installed across your fleet, with the AI tools and the ones that can read every page called out. This is where a device reports whether Blank's network-layer backstop is active or the deployment is DOM-layer only.

## Policy

The rules that turn monitoring into coaching or blocking, by detector, tool, tool category, or user group. See [Policy and enforcement](/docs/policy/) for how precedence and the enforcement modes work. A 30-day preview shows the impact of a rule before you enable it.

## Alerts

Route notable findings to email or your SIEM. Alerts are de-duplicated so one noisy tool doesn't bury you, and the full event stream is available as an NDJSON export for your own pipeline.

## Settings

- **Deployment:** your organization token for [rollout](/docs/deploy/).
- **Enforcement mode:** the fleet-wide posture of monitor, coach, or block.
- **Single sign-on:** SAML and SCIM ([setup](/docs/sso/)).
- **Privacy:** pseudonymization and retention ([details](/docs/privacy/)).

## Roles

Access is enforced on the server, not just hidden in the UI. There are four roles.

| Role | Can do |
|---|---|
| **Owner / Admin** | Everything: read, change policy, manage members, export. |
| **Auditor** | Read and export, but not change policy. |
| **Viewer** | Read only. |

Members arrive by invitation, by SAML domain auto-join, or by SCIM provisioning.