Docs

Refuse an AI app

Decide that a product may not be used in your company, and every laptop takes away its permission to run. For the apps ZYBE can't judge one action at a time, and for any product you want gone.

Rules, Detections: the refused products live on the rule "Product not allowed".

When you'd do this

ChatGPT Desktop, Comet, Grok, Continue, Kilo Code and Augment give ZYBE no moment to step in before an action, so rules like "block credential reads" can't apply to them. The console says so with the issue Agent that can't be blocked. The decision left is whether the product is allowed in your company at all. This is how you say no.

It also works for any product with a hook, where it means every call that tool makes is refused.

Steps

  1. Click the gear icon, then Rules.
  2. Find Refused products in the Unreviewed card.
  3. Type the product's name and press Enter. The name as the Inventory shows it works, like ChatGPT, and so does the short name, like chatgpt-desktop. Add as many as you like.

That's it. Within a minute, every laptop with a whole-machine install:

On a just-me install the laptop does the same for the signed-in user's own copies.

What the developer sees

The app won't open. On a Mac the message is that it can't be opened because of a permission problem. An editor extension stops loading the next time the editor starts. There's no ZYBE message, because the app isn't running anything ZYBE could speak through; tell people in your rollout note.

Allow it again

Remove the name from the list. Within a minute the laptop puts the permission back, and the product goes back to Seen.

Check it held

Open the laptop from Inventory, Endpoints, click Sensor. The product's row reads Not allowed with the reason. If it still reads Seen after a few minutes, the laptop couldn't change the file's permission; that happens on a just-me install when the app was installed by another account. A whole-machine install fixes it.