Your first hour

Five steps take a new workspace from empty to its first alert. Each one ends with the console page where you do it.

1. Enroll a machine

The agent is what reports a machine's AI tools and interactions to the console. Go to Inventory › Machines and choose Enroll machines.

1. Profile. Choose an enrollment profile, or create one. A profile fixes which capture strategies its machines run — see Capture strategies.
2. Install. Under How many machines?, choose One machine and Create install command. The command is shown once and enrolls exactly one machine.
3. Run the command on the machine, as an administrator.

The new machine is Installing until its first heartbeat, then Active. If no heartbeat arrives within 15 minutes of enrollment it is marked Stuck. Deployment covers the command, a reinstall and removal.

2. Connect a platform

A connector reads a platform's API for AI posture: its users, settings and records. Go to Collection › Connectors and choose Connect on the platform's tile — GitHub, Microsoft 365, Google Workspace, OpenAI or Anthropic.

The flow has three steps: Sign in, Check and Rules. Check reads each kind of record once and marks it Readable or Not readable, with the reason. Choose Create connection on the last step.

The connection then has its own page under Inventory › Connections, with Sync now. When one of its rules matches a record, it opens an issue.

3. Write a policy, then enable it

A policy says what to watch for and what to do about it. Go to Governance › Policies and choose New policy. Start from one of the built-in starters, or Start blank and choose the trigger yourself.

A new policy starts disabled, on no machine. When it reads the way you want, set its state:

• Monitor records every hit and raises the policy's alerts and issues, but stops and changes nothing — no block, redaction, ask or notice.
• Enabled takes its actions. Setting this needs the policies:publish permission.
• Disabled puts it back on no machine.

Machines pick up a change of state on their next heartbeat. Policies covers triggers, filters and actions.

4. Check the engines your policies read

An engine answers a question a policy asks about content: does this text hold a secret, is this an attempt at prompt injection. Go to Governance › Engines. Each engine's page says whether it is on, whether it can answer, and how many policies read it.

Engines are on in a new workspace. An engine with no policy reading it is never asked, so it decides nothing on its own. The AI judge also needs a default model before it can answer. Engines describes each one.

5. Read your first alert

An alert is raised by a policy's Raise an alert or Notify action, or when a person a policy asked gives a reason and goes ahead. A plain block is not an alert: it is a decision, listed under Governance › Runs.

Go to Detections › Alerts and open a row. The inspector shows what the policy saw and what was asked.