# Device states {#device-states}

The menu-bar icon and the console device list answer one question: is this device protected right now? This page lists what each state means. [How Takumi Agent works](/docs/t/endpoint/architecture/how-it-works.md#verdict-model) explains how the device works it out.

## The three verdicts {#verdict}

The Mac and the console use different names for the middle verdict. The table shows both:

| On the Mac          | In the console    | Menu bar          | Meaning                                                                                    |
| ------------------- | ----------------- | ----------------- | ------------------------------------------------------------------------------------------ |
| **Protected**       | **Protected**     | Green dot         | Every ecosystem your organization enforces on this device is captured through Takumi Guard |
| **Needs attention** | **Degraded**      | Amber square, `!` | Something is degraded or pending, but nothing is known to be bypassing Guard               |
| **Not protected**   | **Not protected** | Red octagon, `×`  | Installs may be bypassing Guard, or the device can't be trusted                            |

If the agent can't confirm that a part of the protection is working, the device shows **Needs attention** on the Mac (**Degraded** in the console). An agent that has no verdict to report shows **Not reported** in the panel header, with the same amber badge.

macOS notifies the Mac's user when the device stays red, with a **Fix…** action. [Troubleshooting](/docs/t/endpoint/references/troubleshooting.md#repair) lists what each button in the panel does.

### Off by policy is not a fault {#off-by-policy}

An ecosystem your organization doesn't enforce, or an egress lock your policy doesn't require, never changes the verdict. The console shows **Protected, N off by policy**. In the panel, the egress lock row says "off" with a neutral mark instead of amber. [Managing devices](/docs/t/endpoint/features/managing-devices.md#ecosystem-policy) explains where these settings are.

### A blocked container is a note, not a fault {#container-note}

When a process **inside a container** rejects the device certificate, its download was blocked, not bypassed. Nothing reached the registry, so the device is still protected. The verdict stays green: the panel header shows "blocked in `<runtime>`", the **Containers** row names the runtime, and **Health** says "OK, 1 note". The fix is a mount on the developer's side, which [the app window's Containers page](/docs/t/endpoint/features/app-window.md#containers) gives you. A blocked container can also trigger a notification, but only if you turned that on (see [Notifications](/docs/t/endpoint/features/app-window.md#notifications)).

### States that clear on their own {#self-healing}

Some conditions clear without anyone doing anything, for example right after the Mac wakes. The panel and the console mark them **clears on its own**, with the expected time. No action is needed. If one doesn't clear, the device turns Not protected and [Troubleshooting](/docs/t/endpoint/references/troubleshooting.md#repair) applies.

Conditions that wait on a person, such as certificate trust or system extension approval, stay amber until someone acts.

## States that take priority over the verdict {#fleet-states}

In the device list, a device's standing and how recently it reported take priority over its health. The order is **Revoked → Removed → Offline → verdict**.

The Devices page has six filters: **All**, **Protected**, **Degraded**, **Not protected**, **Offline** and **Removed**. Each one lists exactly the devices showing that label. Revoked has no filter: decommissioned devices only appear under All and aren't counted in any other group.

### Offline {#offline}

The device has stopped checking in: the lid is closed, the machine is off, or it has no network. Offline takes priority over whatever verdict it last reported.

**What to do:** ask the user. If it stays offline, check whether the machine was returned or replaced, and [decommission it](/docs/t/endpoint/features/managing-devices.md#decommission) if it's no longer used.

### Removed {#removed}

The agent on the Mac reported that it was being removed, for example by the [uninstall command](/docs/t/endpoint/features/uninstall.md) or by turning off its system extension. The device detail's **Agent removed locally** row shows how and when ([Troubleshooting](/docs/t/endpoint/references/troubleshooting.md#removed) lists each value).

Removed stays until you decommission the device or it enrolls again. A later healthy report doesn't clear it. The verdict is **Not protected**.

**What to do:** check with the user that the removal was intended. If it was, [decommission the device](/docs/t/endpoint/features/managing-devices.md#decommission) to keep the list clean. If it wasn't, investigate.

### Revoked {#revoked}

You [decommissioned the device](/docs/t/endpoint/features/managing-devices.md#decommission) in the console. Its identity and every token issued to it are revoked, and the machine has to enroll again with an enrollment key.

**What to do:** nothing. This is the result of your own action.