Govern your local agents in 10 minutes

The solo-operator path: give the agents running on your own machine (Claude Code, Cursor, any MCP-compatible harness) a verifiable identity, an audit trail, and a kill switch — and put a permissioned gate between them and your files. Nothing here needs a team, an IdP, or an IAM project.

Create a Personal account (any non-disposable email works), confirm your email, and enroll your first agent from the dashboard. You land on the Connect your agent screen: your agent’s credential token, shown once, with ready-to-paste snippets. Losing the token is fine — reissuing mints a fresh one and revokes the old.

2 · Connect the harness (~2 min)

Install the SDK (pip install eniyan) and paste the Claude Code / .mcp.json snippet from the Connect screen. Your agent now carries governed identity: scope checks, run telemetry (metadata only), and live revocation.

3 · Gate your files (~3 min)

Add eniyan-fs with the folders you want your agents to reach — and nothing else:

{
  "mcpServers": {
    "eniyan-fs": {
      "command": "eniyan-fs",
      "env": {
        "ENIYAN_API_KEY": "...",
        "ENIYAN_CREDENTIAL_TOKEN": "...",
        "ENIYAN_AGENT_ID": "...",
        "ENIYAN_FS_ROOTS": "projects=/Users/you/code:notes=/Users/you/notes"
      }
    }
  }
}

Anything outside the roots is refused locally — no network involved, symlinks and .. can’t escape, and key material (.ssh, .env, private keys) is refused even inside a root.
Every access inside the roots is policy-checked and audited by Eniyan — metadata only: root aliases and path hashes, never contents, never full paths.
Writes fail closed when offline; deletes are off unless you grant the scope AND set ENIYAN_FS_ALLOW_DELETE=1.

4 · Try the kill switch (~1 min)

Ask your agent to read a file inside a root — watch the audit row appear. Ask it to read outside the root — refused locally. Then revoke the agent’s credential from its detail page: within the decision-cache window (60 seconds by default, ENIYAN_FS_CACHE_TTL=0 for per-access) every file operation refuses with a message pointing back at the dashboard. Reissue a token to reconnect.

5 · Gate the web (~2 min)

The same idea for websites: on the agent’s dashboard page, open the Web access card, click Enable, and add the sites your agent may visit — that list IS the permission system. Then paste the eniyan-web snippet from the Connect screen (no sites go in the config; the gate syncs your list within a minute).

Each site gets four switches — read (view pages), write (submit forms, post), edit (change or delete what’s there), and download. New sites start read-only, and *.example.com covers a site’s subdomains too.
Pages are screened on your machine for hidden instructions before your agent ever sees them — flagged pages are blocked outright when the agent holds write, edit, or download power, stripped and flagged when it’s read-only. Page content never reaches Eniyan; your audit log records only the domain and what the screen did.
Anything not on your list is refused, every redirect is re-checked, and the same credential revoke that kills file access kills web access too.

6 · Let it shop for you (~3 min)

With the real-browser engine, your agent can buy things — under limits you set, with your approval on every purchase. Your approval authorizes the checkout itself: once you approve, the agent submits the order with whatever the store already accepts — a card saved on your store account, a wallet button, payment on file. No card ever passes through Eniyan or the model.

Set three numbers on the agent’s page: a per-purchase cap, a monthly budget, and an approve-first floor (0 by default — every purchase pauses until you tap Approve in the Purchases inbox, which shows the exact store and amount).
Only stores with the Pay / Transact ability on the allowlist can charge; the approval is one-shot and bound to that exact store and amount — anything else burns it. Budgets are enforced server-side; revoking lands on the very next purchase.
For stores where a card must be typed into the page, set up the local card vault (eniyan-web --setup-card, from the Connect screen; macOS Keychain built in, Windows/Linux via the eniyan[card] extra) — the gate fills it locally under the same one-shot approval, it never reaches Eniyan, and the model only ever sees “visa ****1234”. Checkouts whose card fields live in a payment-provider iframe need that provider’s domain read-allowlisted so the frame can load.

7 · Trade under a mandate (optional)

The same governance enterprise desks use: flip the Trading switch on the agent’s page ($5/month per trading agent, stacking with the $2/agent overage), then define your strategy and grant your mandate at Dashboard → Trading — caps, budgets, instruments, trading hours, all enforced per order, refusals final. Switching the agent off is the kill switch; switching back on resumes. Full reference: Agentic Trading → Personal accounts.

Deeper reference: Harness integration (the SDK, both MCP servers, the runs API) and Agent RBAC when your team grows past one person.