Skip to main content
Quickstart cover — install, enroll, and turn enforcement on. About ten minutes, most of it waiting on macOS approval dialogs. At the end your AI coding agents will be running under your organization’s policy, with their activity visible in the Frontegg Portal.
New to the product? How AgenShield works explains the policy model and enforcement modes in five minutes. Rolling out to a fleet? Use the MDM guide instead — it pre-approves everything below so nobody is prompted.

​
Before you start

​
1. Install

Paste the install link your administrator gave you:
This downloads the signed, Apple-notarized package, installs it, enrolls the Mac with your organization, and starts the background service. You are asked for your password once.
No install link? An administrator creates one in the Frontegg Portal as an install campaign. The link embeds an enrollment token, so nothing has to be typed in by hand and no admin credentials touch the endpoint.

​
2. Grant the three macOS approvals

macOS does not let any security product enable itself silently. On an unmanaged Mac, someone with administrator rights has to approve three things, once. AgenShield walks you through them:
1

Allow the system extensions

System Settings → General → Login Items & Extensions. Approve both AgenShield extensions. Until this is done, nothing is being enforced.
2

Grant Full Disk Access

System Settings → Privacy & Security → Full Disk Access. Enable the AgenShield security extension. Without it the extension cannot evaluate file access, and enforcement stays off.
3

Allow network filtering

Approve the “Filter Network Content” prompt when macOS shows it. Without it, network rules have no effect.
The command detects each approval the moment you grant it and moves on — there is nothing to confirm back in the terminal. Press Enter to re-check immediately if you want.

​
3. Confirm the Mac is healthy

You are looking for a healthy system report — the background service running, your organization’s policy received, and enforcement active:
Every agent in the Installed agents list is already governed by your organization’s policy — there is nothing to enable per agent. The one open item above is the next step: signing in.
The menubar icon shows the same at a glance, and opens the AgenShield dashboard — see The AgenShield app.

​
4. Sign in

Open the AgenShield menubar icon and click Log in — it opens your organization’s sign-in page in the browser. Signing in links the Mac to your user account, so policy can apply rules based on your team, role, or group. Until you sign in, only device-wide rules apply. Prefer the terminal? agenshield login starts the same browser sign-in.

​
5. Use the agent normally

Start the agent the way you always do — there is no new command to learn, and nothing about your workflow changes. What you notice from here depends on the mode your administrator chose:
  • monitor — nothing is blocked; activity is recorded so your security team can see what agents genuinely need.
  • audit or enforce — activity outside policy fails with a permission error, and the block is recorded with the rule that caused it.
See Working with your agents for what changes day to day, and Enforcement modes for what each mode means.

​
If something is not right

doctor checks each component and names what is failing; agenshield doctor --fix attempts a repair. Almost every first-install problem is one of the three approvals in step 2. If it persists, see Common issues.

​
Removing it

No sudo needed — the command asks for your administrator password itself. See Install and uninstall for the full removal path and how to verify nothing is left behind.

​
Next

Rollout playbook

Take this from one Mac to a fleet without breaking developer workflows.

Working with your agents

What changes for the developer, and what a block looks like.