> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guardway.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> What Endpoint AI Risk is, how the Guardway agent, the console and your gateway fit together, and where to start.

**Endpoint AI Risk** is the part of Guardway that runs on your developers' machines. A small agent
(`gw-cli`) inventories the AI tools, skills, MCP servers and accounts on each laptop, measures how
every AI tool is used and what it costs, and, when you choose, routes model traffic through your
gateway and stops risky actions before they run. Everything rolls up into the console under
**Endpoint AI Risk**.

## The three views

The sidebar entry mirrors how the fleet is organized:

<CardGroup cols={3}>
  <Card title="Fleet" icon="laptop" href="/endpoint-ai-risk/fleet">
    One row per machine: who is signed in, which AI tools run there, how its traffic is governed, and what needs attention.
  </Card>

  <Card title="People" icon="users" href="/endpoint-ai-risk/people">
    The same fleet regrouped by person: what they installed, asked, were stopped from doing and spent.
  </Card>

  <Card title="Policy" icon="sliders" href="/endpoint-ai-risk/policy">
    The Endpoint AI Policies machines run, the organization-wide AI Control switches and catalogs, and Access Profiles for gateway keys.
  </Card>
</CardGroup>

## How the pieces fit

| Part | Where it runs | What it does |
| - | - | - |
| **Guardway agent** (`gw-cli`) | Each developer machine | Inventories and risk-scores AI tooling, reads each AI tool's own usage, applies the policy it receives, and reports redacted findings to the console. |
| **Console** | app.guardway.ai | Shows Fleet, People and Policy. Issues enrollment keys and per-machine gateway keys. Signs every policy it sends. |
| **Your gateway** | Self-hosted, or the SaaS Gateway | Receives model traffic from machines in the **Enforce** posture, so requests are governed, logged and priced. Optional. |

A machine starts in **Observe**: traffic is watched and reported, nothing is stopped and Claude
Code is never in the agent's data path. Moving a group of machines to **Enforce** is a policy
change, not a reinstall.

## Getting a machine in

<Steps>
  <Step title="Install the package for the OS">
    A universal `.pkg` for macOS, an `.msi` for Windows, a `.deb` or `.rpm` for Linux. Deploy it with your MDM or install it by hand. Installing the package is the whole install.
  </Step>

  <Step title="Issue an endpoint key in the console">
    **Endpoint AI Risk › Fleet › Connect endpoint**. Name the machine and generate a key. It enrolls one machine and is shown once.
  </Step>

  <Step title="Enroll the machine">
    Run the enroll command the console shows. The machine sends a first report and appears in Fleet within a minute.
  </Step>
</Steps>

[Connect Endpoint](/endpoint-ai-risk/connect/overview) walks through each step, with a page per
operating system.

## What leaves the machine

Only redacted findings and usage metadata: tool names, versions, risk scores, token counts, models,
costs, policy state and the evidence behind a stop, redacted before it leaves. Prompts and replies
stay on the machine, unless a machine is in **Enforce**, where model traffic goes to your gateway
the same way it would without Guardway. Until a machine is enrolled, the agent contacts nothing
except package vulnerability lookups during skill scans. The hosts are listed on
[Network Requirements](/getting-started/network-requirements#endpoint-agent).

## Related

<CardGroup cols={2}>
  <Card title="Connect Endpoint" icon="plug" href="/endpoint-ai-risk/connect/overview">
    Install, enroll and verify a machine.
  </Card>

  <Card title="Agent" icon="terminal" href="/endpoint-ai-risk/agent/overview">
    What the agent finds, how it scores, and every command.
  </Card>

  <Card title="Network Requirements" icon="network-wired" href="/getting-started/network-requirements#endpoint-agent">
    Hosts and ports to allow on each machine.
  </Card>

  <Card title="Privacy and Security" icon="lock" href="/resources/privacy-and-security">
    What Guardway stores and how it is protected.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.