> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Overview > What the AutoElevate integration brings to your Neo Agent setup AutoElevate, from CyberFOX, removes local admin rights and puts each elevation behind an approval. When a standard user runs something that needs admin rights, their machine raises an elevation request and a technician approves or denies it. Connect AutoElevate to Neo and your agents can pull that request onto the ticket, gather the evidence behind it, and decide it with a technician's sign-off. Nobody opens the AutoElevate portal. AutoElevate uses a single API key per MSP. Connect it once and every agent you enable can use it, with permissions you control per agent. ## What Neo can do with AutoElevate Find the pending request behind a ticket, read its state, and approve or deny it. Approving and denying always wait on a technician. The evidence a decision rests on: the file name and path, its size and hashes, whether it is digitally signed, the publisher and the signing certificate, and the user who ran it. The temporary admin sessions granted on a machine — who held one, when it started, and how long it was scheduled for. The rules that resolve elevations automatically, and the scope each applies at — computer, location, company, or your whole account. Managed machines with their OS, elevation mode, and last check-in, so a computer id on a request becomes a machine your technician recognises. Your AutoElevate client hierarchy, used to scope every other lookup to the right client. Account & Audit is also available, read only: partner usage figures for licence reconciliation, and the audit log of user and settings changes. ## Your clients are mapped automatically Neo matches your AutoElevate companies to the companies in your PSA and keeps the mapping on the AutoElevate card's **Organization Mapping** tab, refreshed on each PSA metadata sync. Matching is by name: exact first, then after stripping a legal-form suffix (Ltd, Inc, LLC), then a last-resort AI match for the long tail. AutoElevate exposes no PSA identifier and no website, so name is all there is to match on. `managementSystemCompanyId` looks like a PSA id but is free text that defaults to the company name, so Neo does not use it. **A name match, or one you confirm, is handed straight to your agents**, so they know which AutoElevate company the ticket's client is without looking it up. A match from the AI rung is only a suggestion. It waits on the Organization Mapping tab until someone confirms it. Anything Neo could not match at all stays unmapped and visible on the same tab, where you can set the right company by hand. A mapping you set by hand survives every later sync. Everything except Elevation Requests is read only. AutoElevate's Partner API has no write endpoint for them. ## Why connect AutoElevate * **The elevation queue stops waiting for someone to notice it.** An agent can watch for pending requests and hand a technician a ready decision, with the file and publisher already checked, instead of the technician finding the request themselves. * **The decision rests on evidence the request itself does not carry.** The request record holds almost nothing: no file name, and usually no user. The detail lives on the matching elevation event, and Neo's agent knows to go and read it. * **Approving and denying always require a technician's sign-off**, whatever the agent's automation level. The [AutoElevate API tool](/agents/tools/security/autoelevate-api#safety-controls) reference lists what that covers. ## How agents reach AutoElevate When you enable any AutoElevate permission group on an agent, Neo adds the AutoElevate tool to that agent's toolbox. There is nothing to install. The agent uses the API key you saved in the dashboard, and every call stays inside the areas and access levels you allowed. ## A note on the beta AutoElevate's Partner API is in beta, and CyberFOX may change it without notice. * **The elevation events feed is short.** It holds recent events only — on a live account it covered about nine hours. Neo reads the event while it works the request. Come back to a request days later and its event may be gone. * **Requests are limited to 100 per hour per operation.** Neo paces its own calls to stay inside that. This covers ticket work comfortably. It is not a budget for bulk reporting. ## Where to go next Setup steps for the API key, per-agent access levels, and the safety controls that stay in place.