Capture strategies

A machine enrols with a set of these strategies, fixed at enrolment. Below is what each one does, in the same order used by What each strategy alters.

TLS interception

Gives network steering's listener the certificate authority it needs to decrypt traffic — so it can see content, not just metadata. The root certificate is limited to the workspace's site catalog. It is installed as managed browser policy where the browser supports it (Chrome 131+, Edge), and into the operating system's own trust store for tools with no policy equivalent.

What it cannot see: nothing, by itself — but on its own it does nothing either. It binds no port and steers no traffic; it only supplies the certificate a steering listener decrypts with. Without network steering enrolled alongside it, this strategy has no effect.

Named limits:

• The key is stored in software, per endpoint — there is no fleet-wide root. If a local administrator extracts their own machine's key, only that machine is exposed.
• There is no scheduled rotation. A stored root is only replaced if the machine happens to be reinstalled or reconfigured within thirty days of the root's own expiry.
• It is the only strategy that conflicts with another: you cannot enrol it alongside the browser extension. Both would read the same browser content, and one prompt would be recorded as two interactions.

Network steering

Installs a proxy auto-config (PAC) file, merged with whatever was already on the machine, that steers the browser to a local CONNECT-terminating listener. It also claims routes for the workspace's catalogued services, so traffic that ignores proxy settings reaches the same listener. On its own the listener never decrypts anything — it reads the destination host from the CONNECT request and records the destination, timing, and byte counts.

What it cannot see: request or response bodies, unless TLS interception is enrolled alongside it. A host that never resolves, or resolves to nothing in this address family, is not silently dropped — it is reported as a gap.

Named limits:

• A network_steer machine is never issued a certificate authority. The root only arrives with TLS interception, so this strategy stays metadata-only on its own — by design, not by a setting someone could miss.
• The proxy fails open: if the local listener dies, the generated PAC file still returns a direct route rather than blocking outbound traffic. The machine keeps working, but coverage drops silently until the watchdog and the next heartbeat report it.
• Addresses are resolved once, ahead of time, when the destination set is built — never on every packet. If a service changes address, coverage catches up on the next reconciliation, not instantly.

CLI & IDE tools

Asks each tool's own hook before it acts. Claude Code, Codex CLI, Gemini CLI, Cursor and Devin Desktop can run a small program before a prompt, a shell command, a file read or an MCP call; the agent adds its own beside any the tool already has and answers it with the same rules the network path uses. Nothing is re-routed: the developer's own API key never leaves the tool.

What it cannot see: what came back. A hook reports what a tool is about to do, never the model's response.

Named limits:

• Claude Code cloud sessions cannot be intercepted, by any endpoint mechanism. Their traffic starts on Anthropic's own infrastructure and never touches the machine, and they read no policy from it.
• A hook lets the action through when the agent is not installed. When the agent is installed and can't answer, one fallback decides for every tool: Allow, the default, or Block. Hooks are switched on or off per tool, and the fallback set, under Configuration › AI tools.
• Some settings outrank ours: a Windows policy or a server-managed setting for a tool can make it ignore the file the agent writes. The machine's Protection › CLI & IDE tools table then says Not effective, with the reason, and says Witnessed only once a call from the tool has been seen.
• No effect until the tool starts. A tool that is already open keeps what it read when it started.

Browser extension

Patches fetch and XMLHttpRequest inside the page itself, as soon as the page starts loading. A blocking network-stack layer enforces a verdict the agent already gave, and a declarativeNetRequest floor keeps enforcing block patterns even if the extension's own background worker has been evicted. No certificate, no proxy, no route.

What it cannot see:

• Incognito and Guest windows, unless the workspace's policy explicitly enables them
• the page's own service worker, or anything served from Cache Storage
• response bodies, in any Chrome extension manifest version
• EventSource, WebSocket, sendBeacon, and Worker-originated requests
• file uploads
• anything in another browser, another machine, a native desktop app, or on mobile

Named limits:

• Force-install is a policy set, not a single policy. Omitting any one entry — blocking developer mode, remote debugging, Incognito, Guest sessions — leaves exactly that bypass open.
• Safari has no force-install path at all. It needs a managed containing app delivered by MDM, has no blocking webRequest, and no equivalent of chrome.debugger — a real coverage hole on a Mac fleet, not a footnote.

File inspection

Runs scheduled scans of the directories a profile configures, reading at most one megabyte of each file. Content is redacted before it is hashed, and only a digest of what changed rides the heartbeat — so a fleet where nobody edits anything costs a few dozen bytes a beat.

What it cannot see:

• anything outside the configured folders
• more than the first megabyte of a file
• the full bytes of a model weight — only a digest of the file's start plus its size, so the agent can detect a substitution without reading a multi-gigabyte file end to end on every scan

Named limits:

• The full body is kept only for scannable text files — skills, agent definitions, prompts, MCP connection configs, tool configs, session logs. Everything else keeps a redacted, capped preview.
• A stored body is deleted the moment its file is no longer on the machine; otherwise it ages out with the workspace's run-retention window, thirty days by default.
• The broad home-directory crawl, and the IDE-extension and CLI-posture scanners, are not part of this strategy yet — named here as absent, not assumed present.