The admin dashboard

The dashboard is where you see your shadow-AI footprint and decide what to do about it. It's at useblank.dev/admin, and access is controlled by role (see roles).

The sidebar shows your organization and provides direct access to each area below. On smaller screens, open the navigation menu in the header. Applied filters and dates are included in the URL, so you can share a filtered view, reload it, or return with the browser's Back button. Switching screens through the sidebar remembers each screen's filters for your current session.

Navigation

Section captions such as Activity, AI tools, Policy, and Settings group the links beneath them. Select a page link to navigate.

Open Go to… in the header, or press ⌘K / Ctrl+K, to search destinations. Terms such as “SSO,” “invoices,” “enrollment,” and “custom patterns” find the relevant page or section. Use the arrow keys and Enter to open a result; Escape closes the menu. Navigation restores the destination's applied filters and dates. Identity access, Single sign-on, and Provisioning shortcuts are available to owners and admins.

The header also contains the theme toggle. Your light or dark theme is remembered on this browser. Keyboard users can start with Skip to content; page navigation moves focus to the page heading. Escape closes mobile navigation and returns focus to its launcher.

Saved views

Open Saved views in the header to save an investigation you return to often. On a phone, use the bookmark icon. Save the applied filters and date window from Detections, All events, Tool review, People, or Browser extensions, then give the view a name. Submit any filter edits on the page before saving. People views also retain sort and activity filters; extension views retain the applied search and scope.

Saved views are private to your account in the current workspace and remain available after signing out. Every workspace role can save up to 50 views. Search by name or page, then open a view to return to its filters. Relative periods such as Last 7 days roll forward; calendar dates remain as saved. One-sided calendar ranges keep the existing date-window behavior. Opening a view fetches current data under your current permissions and privacy settings.

Use a view's ••• button to rename it. To replace its filters, apply the new filters on the same page first, then choose Replace saved filters while editing the view. Deletion requires confirmation and only removes the saved preference. Results, open detail records, CSV/export settings, pagination cursors, and temporary identity approvals are never saved. Person filters persist as stable labels and remain usable in either privacy mode. When identifiers are visible, the server converts the filter to a label before saving. When pseudonymization is enabled, choose a Person label from the suggestions rather than a raw device identifier.

If a change cannot be confirmed or another session edits the same view, refresh saved views before trying again. To share an investigation with someone else who has workspace access, copy the filtered page's URL.

Your first session

Sign in with a work email link, Google, or your organization's SSO. For SSO, enter the email assigned by your administrator. Email links can only be used once; use the newest email. After requesting a link, check your inbox and spam folder. Resending becomes available after one minute. A slow request offers recovery and asks you to check your inbox before sending again.

If your account has no organization membership, name your organization to start on Free with up to 100 active device seats and no card required. You become its owner. If you expected an existing workspace, ask your administrator to check your work account before creating another organization. If creation cannot be confirmed, use Check organization to recover the result before retrying.

New organizations continue into Deployment. Existing members who open a bookmarked screen keep its filters while their workspace loads. Workspace lookup failures offer a retry; a deployment-status outage leaves the other workspace screens available without showing an invented device count.

Overview

Overview starts with high and critical detections and unknown AI tools awaiting review. Select 7d, 30d, or 90d to change the reporting period; these periods stay in the link and follow drill-throughs. Pending tools are counted by their last sighting in the selected period. An additional note identifies older pending tools outside it.

Activity cards and chart labels open the underlying events or findings. Catalog tools recorded counts distinct catalog tool IDs across recorded activity. Visits by catalog match distinguishes known tools from visits without a catalog match; a match does not establish your organization's approval decision. Detections are recorded matches, blocks are recorded block events, and overrides are recorded proceed-anyway responses. These counts do not verify successful sends or overall protection coverage.

Activity totals come from a daily rollup scheduled to update every 5 minutes. Detailed views use trailing date windows, so counts at the period boundary can differ. Refresh overview reloads the summary; the loaded time describes when the page fetched it, not when devices reported. A failed refresh retains the last successful result for the same period and marks it as out of date. Changing periods never displays an earlier period's counts under the new label. Requests time out with a retry, and lost access clears the displayed data.

An empty period links to Deployment and reported network protection so you can investigate reporting. Owners, admins, and auditors can download an Export PDF or Export CSV evidence pack for the selected period. Exports are disabled while the summary is loading or out of date; changing periods cancels an unfinished download.

All events

Open Activity → All events for the most recent reported activity. Filter by event type, catalog match, severity, and date window. On a phone, use More filters to open the date and metadata controls; applied metadata filters remain visible in a summary when collapsed. Employee responses can also be narrowed to Proceeded anyway. These filters stay in the link, and Show all events removes event filters while retaining your dates. A catalog match records a tool ID; it does not establish organizational approval. Severity filters match only records that include severity.

Each row shows its event type, a brief summary, the domain and catalog tool when recorded, the server-provided person label, and the event time in your local time zone. Open a detection to investigate it and return to the same event filters. Person links open the matching device activity for the same date window. Discovery and inventory records link to Tool review and Browser extensions respectively. A tool discovery score describes AI-like behavior, not risk.

Load more fetches older records using the same filters. The loaded count describes event records, not employees, visits, or a complete total until you reach the end. Failed pagination keeps your loaded records and offers a retry. Refresh events fetches a fresh first page; failed refreshes and lost access clear the displayed records. Requests time out with a retry rather than spin indefinitely. The feed uses selected metadata; captured content and temporary identity reveals remain in their dedicated views.

Tool review

Under AI tools → Tool review, review unknown AI domains discovered across your devices. These candidates are outside Blank's catalog. Counts show reporting devices, which may differ from people. Counts and discovery scores cover the candidate's recorded history; dates filter domains by their last sighting.

Open Review tool to see first and last sightings, the strongest discovery score, and its available signal breakdown. This score measures AI-like behavior, not risk. Discovery does not capture page text or request content.

Choose Sanction to mark the domain approved, Mark blocked to record it as disallowed, or Dismiss to stop further discovery reports for your organization. Sanction and Mark blocked queue the domain for global catalog review; marking it blocked does not immediately block device access or sends. Read each consequence, then Save decision. Filter by status and open View decision to inspect or change earlier decisions.

Detections

Under Activity → Detections, see the findings themselves: when they occurred, the severity, person, domain, tool, and detection metadata. Filter by tool, person, severity, and date range. Matched content is omitted by default; its availability depends on your organization's content-capture setting and what was recorded.

Open a detection's name to see its detector, source, context, and recorded employee follow-up. Copy link shares a direct link that requires access to your organization. The link continues to work while the record is retained, even after it falls outside the list's reporting window. Back to detections restores the list's dates and filters.

A detection establishes that Blank recorded a match. It does not establish whether data was sent or blocked. An employee's proceed anyway response is shown only when it is recorded against that specific detection. Matched text is shown only when content capture permits it and the record contains it.

People

Review activity grouped by device identifier. These records are not an employee directory or seat count: one person can use several devices, devices can be shared, and events without an identifier may form one unknown record. Recorded visits counts visit occurrences; Detections counts recorded matches. Last recorded event may be an inventory report and does not mean a device is currently online.

Apply an exact Person label and date window, show With detections, or sort by detections, visits, or latest activity. Activity filters, sort order, and the open record are part of the link. Sorting and activity filtering run locally; typing a Person label does not send keystrokes. Select a detection count or open Review activity to investigate findings within the same date window. CSV uses the applied dates, Person and activity filters, and sort order. Capped results show a notice and cannot be exported as a complete file. A failed refresh labels retained masked activity as out of date and disables export; identifiers are hidden while access is rechecked.

Identifiers are pseudonymized by default. Owners and admins can request access with a reason from an open record; a second admin reviews that request under Settings → Privacy & access → Identity access. Pending requests are loaded from the server. Approval permits only the requester to see that record's device identifier for 24 hours; it does not reveal an employee name or captured content. People checks approval before showing an identifier and hides it when access expires. If a request's outcome is uncertain, check its status before submitting another request. With organization pseudonymization turned off, record labels already show device identifiers.

Browser extensions

Under AI tools → Browser extensions, review recorded inventory by AI catalog matches or broad permissions. Search by name, vendor, extension ID, or permission, then open an extension's declared permissions and installation methods. Filters and the open extension are part of the link. Search runs locally on the returned inventory; it does not send keystrokes to the server.

Device counts distinguish installed from enabled extensions. A flag is a review signal, not confirmation of misuse. Permissions are combined across recorded devices and describe declared capabilities; actual website access can differ. Blank itself is excluded from this inventory.

Network protection separates reported available, unavailable, and unknown backstop status. Older reports without a status remain unknown. Availability does not verify a successful block; enforcement mode and policy rules still apply. Unavailable devices link to deployment settings so you can check managed installation. Counts cover devices with stored inventory, not every enrolled or currently online device. Refresh failures preserve the last successful result and label it as out of date; capped results show an explicit notice.

Policy

Under Policy → Rules, set the organization enforcement mode, then create rules by detector, AI tool, or tool category. The builder shows the outcome if the rule wins in the current organization mode. Preview the current draft before saving or enabling it; editing the draft requires a fresh preview. See Policy and enforcement for precedence, gates, and targeting limits.

Under Policy → Detectors, Detector health shows precision estimates, low samples, and the evidence behind automatic demotions. Use Monitor only keeps findings recorded while stopping that detector's coaching and blocking. Restore policy responses restores rule evaluation, still limited by organization mode. Custom patterns is a separate section for creating and testing regex detectors. Drafts and sample text survive switching between these sections in memory, and are cleared when leaving Detectors or signing out.

Deployment

Open Deployment directly from the sidebar to choose your management tool, apply both installation and enrollment settings to a test group, and verify device check-ins. Platform selection is part of the link, so you can bookmark a Google Admin, Intune, or Jamf setup. A new organization with no enrolled devices lands here first.

The status panel distinguishes all enrolled devices from devices that checked in during the last 24 hours. Check-ins confirm enrollment, not activity reporting or blocking coverage. Status refreshes automatically; a connection failure preserves the last successful result and offers a retry. Open Device not appearing? for verification steps, then use Overview and browser extension coverage to assess the rollout. Deployment never changes your enforcement mode. See rollout instructions.

Before expanding the rollout, open an organization-permitted AI tool in Blank's catalog on the enrolled test device, then choose Check recorded visits. This opens All events filtered to visits in the last 7 days. Keep the browser online and refresh if the visit has not arrived. No sensitive test submission is needed. A recorded visit confirms activity delivery; it does not verify coaching or blocking. Overview totals update every 5 minutes.

Notifications

Under Settings → Notifications, choose alerts for high and critical detections or unknown AI tools reaching your device threshold (default: 5 devices). Add email recipients, a Slack incoming webhook, or an HTTPS webhook. Alerts are checked every 15 minutes and limited to one per tool and alert type in 24 hours.

The Notification plan previews your edits before saving. Invalid addresses, more than 20 recipients, incomplete HTTPS URLs, and invalid device thresholds are flagged before a save. Discard changes restores your saved settings.

The weekly summary goes to email recipients only, on Mondays at 14:00 UTC. Add email recipients to receive it; Slack and webhooks receive alerts. Saved destinations describe configuration, not verified delivery. The full event stream is also available as an NDJSON export for your own pipeline.

Follow the Notifications guide for the setup and save workflow.

Evidence packs

Open Evidence packs in the main navigation to generate a dated PDF report or CSV for the last 1, 7, 30, 90, or 365 days. Owners, admins, and auditors can generate packs and read generation history; viewers see an access explanation. Overview also offers quick downloads and a link that carries its selected period into Evidence packs.

Every pack includes catalogued tools, detections by severity, blocks, coaching overrides, current enforcement and device enrolment, policy/configuration changes in the period, monitoring limits, and control-framework mappings. These mappings provide evidence toward controls, not certification of compliance. Device counts are not a count of people or a seat-coverage percentage. Catalogue membership does not establish your organization's approval decision.

Activity totals are summarized by UTC day and include the first day in full; today's totals can still update. Change history uses the trailing date window. Configuration and enrolment reflect the generation snapshot. Employee identifiers, raw change targets, and change payloads are omitted. If the period contains more than 200 policy or configuration changes, generation refuses an incomplete pack: choose a shorter period.

Expand a Generation history record to see its summary, format, period, author, generation time, pack version, and SHA-256 hash. Compare a file's hash with this record to check that its contents match. Copy hash copies the full value. Load older packs continues through the recorded history; Refresh history includes newer generations.

Blank keeps the generation record and hash, not a stored copy of the file. Use these settings selects a previous pack's period and format; generating again uses current records and creates a new file with a new hash. A recorded generation does not confirm that the file was saved. Cancellation or timeout can happen after a pack has been recorded, so refresh history before retrying.

See Evidence packs for generation steps, file verification, and recovery.

Settings

• Team: workspace members and administrator access, separate from employees in People. Owners and admins can invite members, resend or revoke pending invitations, and change roles or remove access. Only owners can manage owners; Team keeps at least one owner. Directory-managed accounts must be changed in your identity provider.
• Privacy & access: separate sections for Privacy, Identity access, Single sign-on, and Provisioning (setup). Each section has a shareable URL. Unsaved form changes stay in memory when switching sections. Leaving Settings or signing out asks before discarding edited Privacy or Single sign-on settings.
• Notifications: alert destinations, thresholds, and the weekly digest.
• Seats & billing: compare active device usage with billed seats, review the current plan and subscription rate, and refresh after changes. Owners can choose a paid plan or use Stripe to manage invoices, payment methods, and cancellation (details).
• Audit log: recorded workspace changes, actor/action/date filters, readable details, and links to current settings. Available to owners, admins, and auditors.

The fleet-wide enforcement mode is under Policy → Rules. See privacy and data handling for privacy defaults and retention.

Follow Team, privacy & access to invite administrators, manage roles, and request a temporary identity reveal. Configure your identity provider using SSO and SCIM. Pricing and subscription management live in Seats and billing.

Edited Privacy, Single sign-on, Notifications, policy rules, and custom patterns ask Keep editing or Discard changes before leaving would lose the draft. Switching between Settings sections or detector tabs keeps drafts in memory. If a save is in progress, navigation waits for it to finish; a failed save keeps your edits. Reloading or closing the tab uses your browser's standard warning. Drafts are not recovered after a reload or a completed sign-out.

This protection applies to sidebar navigation, the command menu, saved views, editor cancellation, sign-out, and browser Back/Forward. It applies when leaving would discard an edited form; unchanged or reverted forms do not prompt.

Roles

Access is enforced on the server, not just hidden in the UI. There are four roles.

Members arrive by invitation, by SAML domain auto-join, or by SCIM provisioning. Team invitations expire after 7 days and require acceptance by the matching verified work email. One account belongs to one workspace. Resending renews the invitation; revoking it prevents acceptance. Removing access also blocks SAML domain auto-join until a new invitation is accepted or the directory actively provisions the account. Directory deprovisioning remains authoritative, including for owners.

Invitation emails are limited to one per minute for each invitation and 30 per workspace per hour, with up to 100 pending invitations. Email sent means accepted for sending, rather than confirmed delivery. If a change times out, refresh the team or check the invitation status before retrying.

Audit log

Open Settings → Audit log to review recorded workspace actions. Owners, admins, and auditors have read-only access; viewers see an access explanation. Search by action name or recorded actor email, or combine an exact actor email, a specific action, and a date window. Filters stay in the URL and are restored when you return to the page. Apply filters commits the whole selection together.

Dates and timestamps use UTC. Expand an entry for readable before/after fields, its recorded resource where supported, and links to the current settings. System and directory actions are labeled separately from human actors. Unknown or older actions still appear with their timestamp and recorded actor, even when there are no displayable details.

Load older entries continues through the selected history without changing the original date window. Refresh history starts a fresh read. Secrets, captured content, employee identifiers, and personal saved-view names and filters are omitted server-side, including for owners. This screen displays recorded actions; it does not offer an audit export or change historical records.

View this page as Markdown →