# Default Jobs

<figure><img src="/files/rSt1AmGban8AKWEcAJc1" alt=""><figcaption></figcaption></figure>

**Audience:** IT admins who need to understand which jobs ship with Keeper Privilege Manager, what each one does, and which executables it invokes.

Jobs are defined in the `Jobs/` directory. The tables below group them by purpose and list the main task commands or executables each job uses. For the job JSON format and field reference, see [Jobs: Definition & Format](/keeperpam/endpoint-privilege-manager/reference/jobs-definition-and-format.md). For how jobs are discovered and loaded, see [Plugin & Job Registration](/keeperpam/endpoint-privilege-manager/reference/plugin-and-job-registration.md).

## Policy Control Jobs

These jobs handle `PolicyEvaluationPending` events — they run the configured controls (MFA, justification, approval) and publish allow or deny responses.

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Job ID</th><th>Description</th><th>Trigger</th><th>Main Tasks / Executables</th></tr></thead><tbody><tr><td><code>privilege-elevation-policy-controls</code></td><td>Handles pending evaluations for Privilege Elevation policies. Runs MFA, justification, and approval controls.</td><td>Event: <code>PolicyEvaluationPending</code> (PrivilegeElevation, has desktop)</td><td><code>KeeperMfa</code>, <code>KeeperJustification</code>, <code>KeeperApproval</code>, <code>display-message</code>, <code>publish-mqtt</code>, <code>show-toast</code>, <code>check-approval-provider</code>, <code>echo</code>, HTTP error handler</td></tr><tr><td><code>privilege-elevation-policy-controls-macos</code></td><td>Same as above for macOS PAM / System Extension flow.</td><td>Event: <code>PolicyEvaluationPending</code> (alternate when the standard job's condition is not met)</td><td><code>KeeperMfa</code>, <code>KeeperJustification</code>, <code>KeeperApproval</code>, <code>display-message</code>, <code>publish-mqtt</code>, <code>show-toast</code></td></tr><tr><td><code>file-access-policy-controls</code></td><td>Handles pending evaluations for File Access policies. Runs MFA, justification, approval; can create execution grants.</td><td>Event: <code>PolicyEvaluationPending</code> (FileAccess)</td><td><code>KeeperMfa</code>, <code>KeeperJustification</code>, <code>KeeperApproval</code>, <code>display-message</code>, <code>publish-mqtt</code>, <code>show-toast</code>, <code>check-approval-provider</code>, HTTP create-execution-grant</td></tr><tr><td><code>file-access-policy-controls-headless</code></td><td>Headless variant — no UI; sends pending, allow, or deny via MQTT.</td><td>Event: <code>PolicyEvaluationPending</code> (FileAccess, no desktop)</td><td><code>log-message</code>, <code>publish-mqtt</code>, HTTP create-execution-grant</td></tr><tr><td><code>default-policy-controls</code></td><td>Handles pending evaluations for CommandLine and other policy types that are not Privilege Elevation, File Access, or HTTP Access.</td><td>Event: <code>PolicyEvaluationPending</code> (not PrivilegeElevation, FileAccess, or HttpAccess; has desktop)</td><td><code>KeeperMfa</code>, <code>KeeperJustification</code>, <code>KeeperApproval</code>, <code>display-message</code>, <code>publish-mqtt</code>, <code>show-toast</code>, <code>check-approval-provider</code>, <code>echo</code></td></tr><tr><td><code>default-policy-controls-headless</code></td><td>Headless variant — forwards pending or deny via MQTT.</td><td>Event: <code>PolicyEvaluationPending</code> (alternate when the standard job's condition is not met)</td><td><code>publish-mqtt</code></td></tr></tbody></table>

## Privilege Elevation Jobs

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Job ID</th><th>Description</th><th>Trigger</th><th>Main Tasks / Executables</th></tr></thead><tbody><tr><td><code>LaunchPrivilegeElevation</code></td><td>Launches the requested application with elevation. Optionally runs a redirect check first, then launches the elevated process or a configured substitute.</td><td>Event: <code>LaunchPrivilegeElevation</code></td><td><code>RedirectEvaluator</code> (check-redirect), <code>publish-mqtt</code>, HTTP launch-substitute / launch-elevated / create-execution-grant, <code>display-message</code>, <code>cmd</code></td></tr><tr><td><code>LaunchApprovedRequest</code></td><td>Launches an already-approved elevation request, for example from the keeperAgent UI.</td><td>Event: <code>LaunchApprovedRequest</code></td><td>HTTP ephemeral/launch API, <code>cmd</code>, <code>publish-mqtt</code></td></tr><tr><td><code>create-approved-request-from-policy-result</code></td><td>Creates an approved request from a policy result so it can be launched later.</td><td>Event (from policy controls flow)</td><td><code>publish-mqtt</code>, HTTP</td></tr></tbody></table>

## File Access Jobs

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Job ID</th><th>Description</th><th>Trigger</th><th>Main Tasks / Executables</th></tr></thead><tbody><tr><td><code>GrantFileAccess</code></td><td>Grants temporary file access to a path for a user.</td><td>Event or API</td><td><code>KeeperFileAccessPolicyEnforcer</code> (grant)</td></tr><tr><td><code>RevertFileAccess</code></td><td>Reverts a file access grant.</td><td>Event or API</td><td><code>KeeperFileAccessPolicyEnforcer</code> (revert)</td></tr><tr><td><code>ApplyFileAccessPolicies</code></td><td>Applies file access policy rules from the backend.</td><td>Event or schedule</td><td><code>KeeperFileAccessPolicyEnforcer</code></td></tr><tr><td><code>FileAccessStartupCleanup</code></td><td>Cleans up expired file access entries at agent startup.</td><td>Event: <code>Startup</code></td><td><code>KeeperFileAccessPolicyEnforcer</code> or HTTP</td></tr><tr><td><code>LaunchFileAccess</code></td><td>Launches an application with the appropriate file access context.</td><td>Event: <code>LaunchFileAccess</code></td><td><code>show-toast</code>, HTTP launch-with-file-access</td></tr></tbody></table>

## Inventory Jobs

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="160.3333740234375">Job ID</th><th width="241.666748046875">Description</th><th>Trigger</th><th>Main Tasks / Executables</th></tr></thead><tbody><tr><td><code>inventory-basic</code></td><td>Basic system inventory — machine, OS, and related metadata.</td><td>Schedule or event</td><td><code>KeeperInventoryBasic</code></td></tr><tr><td><code>file-inventory</code></td><td>File-level inventory of executables and related assets.</td><td>Schedule (typically every 7200 minutes)</td><td>File inventory binary</td></tr><tr><td><code>user-inventory</code></td><td>User account inventory.</td><td>Schedule or event</td><td>User inventory executable</td></tr></tbody></table>

## Risk Assessment Jobs

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="157">Job ID</th><th>Description</th><th>Trigger</th><th>Main Tasks / Executables</th></tr></thead><tbody><tr><td><code>composite-risk-evaluation</code></td><td>Computes a composite risk score from location, user, application, and machine risk factors.</td><td>Event (from policy or other jobs)</td><td><code>CompositeRiskEvaluator</code>, <code>echo</code></td></tr><tr><td><code>user-risk-assessment</code></td><td>User risk score.</td><td>Event or schedule</td><td>Risk assessment executable</td></tr><tr><td><code>machine-risk-assessment</code></td><td>Machine risk score.</td><td>Event or schedule</td><td>Risk assessment executable</td></tr><tr><td><code>location-risk-assessment</code></td><td>Location risk score.</td><td>Event or schedule</td><td>Risk assessment executable</td></tr><tr><td><code>file-risk-assessment</code></td><td>File risk score.</td><td>Event or schedule</td><td>File risk assessment executable</td></tr><tr><td><code>url-risk-assessment</code></td><td>URL risk score.</td><td>Event or schedule</td><td>URL risk assessment executable</td></tr></tbody></table>

## Configuration and Maintenance Jobs

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Job ID</th><th>Description</th><th>Trigger</th><th>Main Tasks / Executables</th></tr></thead><tbody><tr><td><code>ProcessConfigurationPolicies</code></td><td>Processes configuration policies from the backend — settings updates, job updates, and similar.</td><td>Event: <code>Startup</code> or schedule</td><td><code>KeeperConfigurationPolicyProcessor</code></td></tr><tr><td><code>registration</code></td><td>Registers the agent with the Keeper backend.</td><td>Event: <code>Startup</code></td><td><code>KeeperRegistrationHelper</code></td></tr><tr><td><code>log-version-info</code></td><td>Logs version information, for example when an error threshold is reached.</td><td>Event (from Logger or manual)</td><td>HTTP or script</td></tr><tr><td><code>locale-cache-cleanup</code></td><td>Cleans the locale cache.</td><td>Schedule or event</td><td>Script or executable</td></tr><tr><td><code>ephemeral-account-cleanup-if-unused</code></td><td>Removes an ephemeral account if it is no longer in use.</td><td>Schedule (typically every 30 seconds)</td><td>HTTP ephemeral cleanup endpoint</td></tr><tr><td><code>send-audit-event</code></td><td>Sends an audit event to the backend or logger.</td><td>Event</td><td><code>publish-mqtt</code> or HTTP</td></tr><tr><td><code>monitor-and-notify-notification</code></td><td>Sends a notification when a policy would have matched in Monitor &#x26; Notify mode.</td><td>Event</td><td><code>show-toast</code> or <code>publish-mqtt</code></td></tr><tr><td><code>keeperagent-silent-expiration-check</code></td><td>Checks approval expiration silently for keeperAgent.</td><td>Schedule</td><td>HTTP or script</td></tr></tbody></table>

## Notification and UI Launch Jobs

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Job ID</th><th>Description</th><th>Trigger</th><th>Main Tasks / Executables</th></tr></thead><tbody><tr><td><code>send-toast</code></td><td>Sends a toast notification to the user.</td><td>Event (from menu or policy)</td><td><code>show-toast</code> (built-in)</td></tr><tr><td><code>ShowAgent</code></td><td>Launches the keeperAgent UI on the user's desktop.</td><td>Event: <code>ShowAgent</code> (from KeeperClient menu)</td><td><code>keeperAgent</code></td></tr><tr><td><code>StartKeeperClient</code></td><td>Starts the KeeperClient system tray application.</td><td>Event (Startup or menu)</td><td><code>KeeperClient</code></td></tr></tbody></table>

## Least Privilege Jobs

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Job ID</th><th>Description</th><th>Trigger</th><th>Main Tasks / Executables</th></tr></thead><tbody><tr><td><code>least-privilege-check</code></td><td>Checks and enforces least-privilege rules — for example, removing admin rights from users.</td><td>Event or schedule</td><td><code>KeeperLeastPrivilegeEnforcer</code></td></tr><tr><td><code>LaunchLeastPrivilegeEnforcer</code></td><td>Launches KeeperLeastPrivilegeEnforcer, for example for CommandLine approval in headless mode or to create a sudoers entry.</td><td>Event: <code>LaunchLeastPrivilegeEnforcer</code></td><td><code>KeeperLeastPrivilegeEnforcer</code>, <code>publish-mqtt</code></td></tr></tbody></table>

## Error Handling Jobs

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Job ID</th><th>Description</th><th>Trigger</th><th>Main Tasks / Executables</th></tr></thead><tbody><tr><td><code>policy-evaluation-error-handler</code></td><td>Handles policy evaluation errors such as a missing file path. Sends a deny or error response.</td><td>Event (triggered by HTTP from other jobs)</td><td><code>display-message</code>, <code>publish-mqtt</code></td></tr><tr><td><code>policy-evaluation-error-handler-headless</code></td><td>Headless variant — no UI; sends response via MQTT.</td><td>Event</td><td><code>publish-mqtt</code></td></tr></tbody></table>

### PAM Configuration Jobs (Linux / macOS)

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="239.6666259765625">Job ID</th><th width="228.3333740234375">Description</th><th width="102">Trigger</th><th>Main Tasks / Executables</th></tr></thead><tbody><tr><td><code>configure_pam_module</code></td><td>Configures the PAM module for Linux or macOS.</td><td>Event or manual</td><td>PAM configuration script or executable</td></tr><tr><td><code>remove_keeper_pam_module</code></td><td>Removes the Keeper PAM module.</td><td>Event or manual</td><td>PAM removal script or executable</td></tr></tbody></table>

## Task and Executable Reference

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="320.6666259765625">Task or Executable</th><th>Purpose</th></tr></thead><tbody><tr><td><code>KeeperMfa</code></td><td>MFA UI — the user completes multi-factor authentication when a policy requires it</td></tr><tr><td><code>KeeperJustification</code></td><td>Justification UI — the user enters a business reason when a policy requires it</td></tr><tr><td><code>KeeperApproval</code></td><td>Approval UI — sends the request to approvers; user or approver sees pending approvals</td></tr><tr><td><code>KeeperMessage</code></td><td>Used by <code>display-message</code> and notifications to show messages to the user</td></tr><tr><td><code>display-message</code></td><td>Shows a message dialog to the user with a title, body, and severity level</td></tr><tr><td><code>show-toast</code></td><td>Shows a toast notification via the OS notification system</td></tr><tr><td><code>publish-mqtt</code></td><td>Publishes a message to an MQTT topic — responses, audit events, launch events</td></tr><tr><td><code>check-approval-provider</code></td><td>Routes approval to Keeper or an external provider</td></tr><tr><td><code>RedirectEvaluator</code></td><td>Checks whether an elevation request should be redirected to a substitute executable</td></tr><tr><td><code>keeperAgent</code></td><td>Agent UI — manage requests and view status</td></tr><tr><td><code>KeeperClient</code></td><td>System tray application — notifications, menu, and launching elevation requests</td></tr><tr><td><code>KeeperRegistrationHelper</code></td><td>Registers the agent with the Keeper backend</td></tr><tr><td><code>KeeperFileAccessPolicyEnforcer</code></td><td>Grants and reverts file access; applies file access policies</td></tr><tr><td><code>KeeperConfigurationPolicyProcessor</code></td><td>Processes configuration policies — settings updates, job updates</td></tr><tr><td><code>CompositeRiskEvaluator</code></td><td>Calculates the composite risk score from multiple risk inputs</td></tr><tr><td><code>KeeperInventoryBasic</code></td><td>Collects basic system inventory</td></tr><tr><td><code>KeeperLeastPrivilegeEnforcer</code></td><td>Enforces least privilege rules — sudoers management, admin removal</td></tr><tr><td>HTTP tasks</td><td>Call the local API — for example, launch elevated, create execution grant, ephemeral cleanup</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/endpoint-privilege-manager/reference/default-jobs.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.