Skip to main content
For individual machines, the watcher installer is the fastest path. For a fleet, the watcher deploys via Jamf or Mosyle on macOS, or Intune / Group Policy / a login script on Windows — and because there is no CA to trust and no proxy to configure on either platform, the rollout is much lighter than the old proxy-based approach. (Agent SDKs integrate with the gateway separately and need no per-machine certificate.)
The exact scripts and MDM runbook ship in the IT & CISO Deployment Package (provided under NDA). This page is the high-level shape.

​
How fleet deployment works

1

Package the watcher

Bundle enfors_watcher.py, the watcher.env config, and the ai.enfors.watcher.plist LaunchAgent template.
2

Deploy silently

Push the files to ~/.enfors/hooks/ and load the LaunchAgent as a Jamf script. No certificate profile, no sudo, no keychain changes.
3

Scope and test

Scope the policy to your AI-engineering group and test on one machine per platform before fleet rollout.
4

Each user signs in once

Because auth is per-user Cognito OAuth, each user runs enfors login once (a browser sign-in). After that, tokens refresh automatically.
The menu bar / tray disclosure indicator is compiled on the endpoint. On macOS this requires the Xcode Command Line Tools — on machines without them the installer skips it (monitoring is unaffected); ship CLT via MDM, or re-run the installer after installing them, to get the visible-monitoring mark fleet-wide. On Windows it compiles unconditionally — nothing extra to ship.

​
Review checklists

  • Package the watcher files + LaunchAgent (macOS) or point the policy at the installer command directly (Windows)
  • Deploy silently via Jamf/Mosyle (macOS) or Intune/GPO/login script (Windows)
  • Scope to the AI-engineering group; test on one machine per platform first
  • Communicate the one-time enfors login step to users

​
Fleet revocation & offboarding

  • Revoke a user: disable them in Cognito → watcher uploads stop and tokens can’t refresh.
  • Offboard a machine: enfors stop, then remove the LaunchAgent (macOS) or Scheduled Task (Windows) and ~/.enfors/hooks/ via your MDM/GPO policy.
  • Nothing to untrust: there is no CA in the keychain (macOS) or certificate store (Windows), and no proxy to remove, on either platform.