Policy management for Linux desktops

Zero-touch enrollment On domain-joined machines, agents enroll automatically using their Kerberos ticket — no tokens, no manual steps. For machines outside a domain, a short-lived one-time token generated from the web UI is used instead. Either way, mTLS certificates are exchanged automatically after the initial authentication and stored securely on the agent.

Real-time policy delivery Policies reach every enrolled node the moment they are published. Persistent gRPC streams and delta sync keep bandwidth minimal and guarantee consistency — even across thousands of nodes or through network interruptions.

Compliance without complexity Every policy change, authentication event, and enforcement action is recorded in a tamper-evident audit log. Built-in RBAC, LDAP/AD integration, and support for Kerberos and WebAuthn align access controls with your existing directory services — ready for compliance reviews out of the box.

Simple to deploy and operate A single server binary backed by PostgreSQL, and a single lightweight agent. No message queues, no sidecars, no external dependencies. Install from a native package, manage with systemd — from zero to your first enrolled node in minutes.