When an agent goes wrong

The web app's Help Center has a guide for it, and four runbooks:

• revoke and rotate a key, including a member's key, by an administrator;
• stop a runaway agent;
• suspend a service account, and resume it;
• reconstruct what an agent did. Both logs filter by credential and show the exact key on every row, and every MCP call can be read back with its outcome and the reason for a refusal.