Managed devices & licenses

The same local gates a PACH 1 person installs on their own computer (files, commands, the web, email, and the computer check), licensed for your organization's computers and set up from the dashboard. You set the baseline once, your device management tool enrolls each computer, and the people who use those computers ask you for changes from a small portal of their own. It lives on the Devices section of the dashboard, on every EACH 1 plan.

The four things

• A profile is the baseline for a set of computers: the folders the apps may work in, the commands they may run, the websites and the email contacts and folders, the permissions the computer's agent declares, and which AI apps to connect. Every computer on a profile gets exactly these settings, and an edit to the profile lands on every one of them.
• A device holder is the person a computer is issued to. Adding them is the attestation: no second person has to approve it. A holder is never a seat and never sees the dashboard; they sign in by emailed link or passkey to the request portal and nothing else. Someone already on your account can hold a computer too.
• A computer is one enrolled device with one agent. All the AI apps on it share that one identity, credential and key, and the key is bound to that agent: the account's API key never reaches the computer.
• A request is what a holder asks for: a website, an email contact or folder, a folder, a command, or something else in their own words. You approve it for that computer alone or for the whole profile, or decline it with a reason they will read.

Turning it on

Two add-ons on the billing page, each priced per unit and billed on your plan: Managed devices at $10 per enrolled computer per month, and PACH 1 licenses at $15 per license per month. A managed computer's agent is covered by the device price and is not counted among your billed agents. Either add-on can be switched off only once nothing is enrolled or issued under it. See Billing, plans & add-ons.

The profile

The Profiles tab holds the same four cards an agent's own page has (Folders, Commands, Web access, Email) plus the agent's permissions and the apps to connect, and it refuses exactly what an agent's page would refuse. Nothing is enforced from the profile itself: when a computer enrolls, and whenever the profile changes, Eniyan writes the profile onto that computer's agent as ordinary rows, so every check runs exactly as it does for a hand-configured agent. The profile also owns its join token, the one your device management tool redeems; rotating it stops the old one at once and changes nothing for computers already enrolled.

You can still change one computer: an edit on its agent's page becomes that computer's own, and the profile stops touching that entry there. Anything you add that the profile does not have is an extra the profile never removes. Reset on the computer puts it back to the profile alone. In-session website approvals are off on a managed computer: nobody is there to answer per computer, so a holder asks through the portal instead.

People

On the People tab you add a holder with their first name, last name and a work email on one of your organization's domains, or pick someone already on the account. A new holder gets a verification email that is also their first sign-in. Removing a holder is refused while a computer is still enrolled to them; remove the computer first. A member you picked keeps their seat and their dashboard; removing them as a holder only ends the attestation.

Installing with your device management tool

The Install tab gives you one script for Mac, Windows or Linux. It is the same for every computer and carries no secret, so it can be stored and logged in your management console. Your policy sets two variables for it: ENIYAN_JOIN_TOKEN, the profile's join token, and ENIYAN_HOLDER_EMAIL, the email of the person the computer is issued to. Run it in that person's own signed-in session, never as root or SYSTEM, and run it again on a schedule: every run reports in, so the computer's last seen stays fresh and an app installed later gets connected.

In order, the script

• installs the Eniyan package for that person;
• enrolls the computer under the holder's email, named after its host name. A person who is not in People, or a token that was rotated, stops it here with nothing changed;
• starts the computer check first: eniyan-scan sends its first report before anything else is written, and installs its background checks. What it finds appears on the Fleet tab under the computer's name;
• enrolls the computer's one agent, when at least one app the profile names is on the computer, and connects each such app to the gates. Until the next release of the eniyan package, the agent's credentials go into each app's settings file and the command gate is not connected; make the script again once it is out;
• reports in with the apps it found.

The request portal

A holder signs in at /portal. They see their computers and what each one may do now, in plain words, one form to ask for a change, and their asks with the answer. They can withdraw an ask while it is waiting. They never approve anything: the words there are ask and your admin decides.

You decide on the Requests tab, and each ask also appears in your Inbox under Waiting on me. Approve asks where it applies: This computer only adds the entry to that computer as an extra, The profile adds it to the profile and so to every computer on it. Decline needs a reason, which the holder reads. Admins are emailed when an ask arrives and the holder is emailed when it is decided; neither email carries the ask itself.

Day two

• The Computers tab lists every enrolled computer with its holder, profile, last seen and the apps it reported, and opens each one: its agent, its four cards, Reset and Revoke.
• Revoke retires the computer's agent, which revokes its credential and key, and ends its computer check. What the check found stays on the Fleet tab. Running the install again on that computer enrolls it afresh.
• Stopping every agent on the account stops the managed computers' agents too, and a new enrollment waits while the stop is on.
• The holder's operator credential renews on its own while the holder is active. A holder who leaves is removed on the People tab, after their computers.

PACH 1 licenses for people on their own computers

The Licenses tab issues a PACH 1 account to people on your email domains (employees, or students at a university) for their own computers. Each gets an emailed invitation; the account they sign up for is theirs, with its own dashboard, purchases, switches and computer check, and you pay for it. You see whether it is in use (status, when it was accepted, the day it was last active, how many agents) and never what they do with it: not their agents, sites, folders, purchases or findings. A license can name a profile; its settings are then applied to each new agent as defaults the person may change, never as an enforced baseline. The person's side is in the PACH 1 billing guide.

What is recorded

The same rule as everywhere: Eniyan sees names, ids, domains and fingerprints, never file contents, page contents or a command's text. A profile's folder list is the one kind of path it stores, exactly as an agent's own Folders card is, so the gates can follow it. The audit trail records who enrolled, approved or declined what, by id, with a token's prefix and never the token, and whether an ask carried a note, never the note. The computer check reports what the Fleet tab shows and nothing more; see the security model.

Limits

• One agent per computer: the apps on it are told apart by what they report, not by separate identities.
• A holder asks only for the four kinds of entry the gates understand, or in their own words. Payment limits, agent-to-agent links and trading are not theirs to ask for.
• The script needs the person in People first, and the computer online: a refusal from Eniyan stops it before it changes anything.
• On Windows, commands need the one-time administrator setup the harness guide describes.
• The apps the script can connect are the ones the PACH 1 guided setup knows; an app it cannot write safely gets its settings printed in the script's output for the person to add.