Skip to main content

​
What this is for

A machine with the agent installed is still local-only. Activating it means enrolling it with an endpoint key so it reports to the console, checking that the first report arrived, and settling which install mode it runs. This page is for the person doing that on one machine or scripting it for many.

​
Enroll

1

Issue a key

In the console open Endpoint AI Risk › Fleet › Connect endpoint, type a Machine label and click Generate key. Copy the sk-ep-… key; it is shown once.
2

Run the enroll command as the signed-in user

The key is stored in that user’s agent data folder with owner-only permissions and never logged. --verify pushes a first report immediately. The running agent picks the enrollment up on its own; no restart is needed.
3

Check Fleet

The machine appears in Fleet within a minute, with the label you gave it, the signed-in user, its OS and agent version. A blank value means the machine has not reported that item yet.
What the key is. An endpoint key only enrolls. On enrollment the agent exchanges it for the machine’s own credential, which is valid for one hour and renewed automatically, so the shared key never reports. Agents older than 0.2.119 keep reporting with the key itself. Revoking the machine’s credential later (Revoke device access in Fleet) stops it for good. What to run afterwards. Nothing. The agent keeps scanning and reporting as long as it runs, which the package arranges at every sign-in. gw-cli discover --deep --report pushes a fresh inventory on demand, and gw-cli enroll --remove stops reporting and clears the saved key.

​
Managed installs

Enrollment is per user: the key lands in the data folder of whoever runs the command, and a key written by root is never read by a user’s agent. From a deployment tool, run it as the user: On a machine running the managed mode, gw-cli enroll targets the running managed agent itself, so the one command enrolls the machine-wide service as well.
One key per machine. A key reused across machines makes them indistinguishable in Fleet until each has exchanged it for its own credential, and it cannot be revoked for one machine alone.

​
Install modes

Every package installs observe unless told otherwise. The mode decides what the agent is able to do on the machine; the console’s policy decides what it does. Switching an installed machine:
Both directions are safe while developers are working. Moving back to observe unwires every AI tool before the service stops, so no open session is left pointing at a service that is gone.
Roll out in order: install observe to everyone, create a policy and leave Live guard on Record for a week, then move a pilot group to the managed install and switch the policy to Block or Enforce for that group only.

​
Break-glass

To stop applying organization policy on one machine without uninstalling, for example while diagnosing a developer’s problem:
Fleet shows the machine’s state, and skill custody stands down while break-glass is on.

​
Troubleshooting