Device states
The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.
The menu-bar icon and the console device list answer one question: is this device protected right now? This page lists what each state means. How Takumi Agent works explains how the device works it out.
The three verdicts
The Mac and the console use different names for the middle verdict. The table shows both:
| On the Mac | In the console | Menu bar | Meaning |
|---|---|---|---|
| Protected | Protected | Green dot | Every ecosystem your organization enforces on this device is captured through Takumi Guard |
| Needs attention | Degraded | Amber square, ! | Something is degraded or pending, but nothing is known to be bypassing Guard |
| Not protected | Not protected | Red octagon, × | Installs may be bypassing Guard, or the device can't be trusted |
If the agent can't confirm that a part of the protection is working, the device shows Needs attention on the Mac (Degraded in the console). An agent that has no verdict to report shows Not reported in the panel header, with the same amber badge.
macOS notifies the Mac's user when the device stays red, with a Fix… action. Troubleshooting lists what each button in the panel does.
Off by policy is not a fault
An ecosystem your organization doesn't enforce, or an egress lock your policy doesn't require, never changes the verdict. The console shows Protected, N off by policy. In the panel, the egress lock row says "off" with a neutral mark instead of amber. Managing devices explains where these settings are.
A blocked container is a note, not a fault
When a process inside a container rejects the device certificate, its download was blocked, not bypassed. Nothing reached the registry, so the device is still protected. The verdict stays green: the panel header shows "blocked in <runtime>", the Containers row names the runtime, and Health says "OK, 1 note". The fix is a mount on the developer's side, which the app window's Containers page gives you. A blocked container can also trigger a notification, but only if you turned that on (see Notifications).
States that clear on their own
Some conditions clear without anyone doing anything, for example right after the Mac wakes. The panel and the console mark them clears on its own, with the expected time. No action is needed. If one doesn't clear, the device turns Not protected and Troubleshooting applies.
Conditions that wait on a person, such as certificate trust or system extension approval, stay amber until someone acts.
States that take priority over the verdict
In the device list, a device's standing and how recently it reported take priority over its health. The order is Revoked → Removed → Offline → verdict.
The Devices page has six filters: All, Protected, Degraded, Not protected, Offline and Removed. Each one lists exactly the devices showing that label. Revoked has no filter: decommissioned devices only appear under All and aren't counted in any other group.
Offline
The device has stopped checking in: the lid is closed, the machine is off, or it has no network. Offline takes priority over whatever verdict it last reported.
What to do: ask the user. If it stays offline, check whether the machine was returned or replaced, and decommission it if it's no longer used.
Removed
The agent on the Mac reported that it was being removed, for example by the uninstall command or by turning off its system extension. The device detail's Agent removed locally row shows how and when (Troubleshooting lists each value).
Removed stays until you decommission the device or it enrolls again. A later healthy report doesn't clear it. The verdict is Not protected.
What to do: check with the user that the removal was intended. If it was, decommission the device to keep the list clean. If it wasn't, investigate.
Revoked
You decommissioned the device in the console. Its identity and every token issued to it are revoked, and the machine has to enroll again with an enrollment key.
What to do: nothing. This is the result of your own action.