Skip to main content
Fleet enrollment is how an admin deploys Shadow AI across many employees at once. Instead of handing out a shared API key, each device redeems a one-time token for its own least-privilege credential — so you can attribute activity per employee and revoke any single device instantly, without touching the rest.

​
Roll it out

1

Create an enrollment token

In the dashboard, go to Fleet → Enrollment Tokens and create one. You can limit it by platform and set a max number of uses or an expiry. The token is shown once — copy it then.
2

Each device redeems it

Employees run one command (or your MDM runs it for them):
The device receives a scan-only credential bound to your organization’s fleet — no shared secret, no per-employee account needed.
3

Activity rolls up to you

Every verdict is tagged with the device and surface (desktop / browser). Admins see the whole fleet’s AI activity in one place; employees never see each other’s data.
4

Revoke any device in one click

Fleet → Devices → Revoke. That device’s credential is deactivated immediately and its next request is rejected — the rest of the fleet is unaffected.

​
Why per-device credentials

Least privilege

Device credentials can only scan — even if one leaked, it can’t reach management or proxy endpoints.

Clean attribution

See which employee triggered a block, via a per-device label — no separate user account required.

Scoped visibility

Fleet activity is visible to your org’s admins only, never through a shared key.
The device credential is an ordinary PromptGuard API key presented as X-API-Key, marked scan-only. What it may reach is generated from the two mount prefixes the guard router is served under (/api/v1 and /api/v1/proxy, the second because the Python SDK defaults its base URL there), so the same handler is reachable by both names:
  • /api/v1/guard and /api/v1/proxy/guard
  • /api/v1/agent/managed-policy and /api/v1/proxy/agent/managed-policy — exact match only. /agent as a family stays closed; this one read-only policy poll is the exception
  • /api/v1/enroll, and the /api/v1/exceptions, /api/v1/policies and /api/v1/tool-requests subtrees, so a device can file and poll its own requests
A trailing slash cannot change the outcome: paths are compared with it stripped, so /api/v1/guard/ now 404s for everyone rather than 403-ing only scan-only keys. Anything not on that list fails closed with 403 scope_denied.

​
Org-managed updates

On the fleet plan (shadow_ai_fleet — Scale gateway tier or Shadow standalone), admins control how the agents on enrolled devices update:
  • Force the update mode — e.g. require Automatic so every device stays current, regardless of what the user picks locally.
  • Pin the release channel — keep the fleet on stable, or move a test group to the beta channel.
  • Set a minimum version — devices below the floor are forced to update. Until they do, they keep protecting with their current policy (a stale agent never disarms), but coverage-reducing controls are locked.
On a managed device, the corresponding controls in the app’s Settings show “Managed by your organization” and can’t be changed by the user. Everything else about the app behaves the same.

​
For automation

If you’re scripting enrollment or building tooling, these are the endpoints behind the dashboard: See the API Reference for full request and response schemas.

​
Next steps

Choose where your data runs

Keep the engine in our cloud, on your own infrastructure, or fully air-gapped.