From 7a6f52b948686e18ad06d7e1663eb93214720811 Mon Sep 17 00:00:00 2001 From: Shyamquilr Date: Thu, 9 Apr 2026 11:52:30 +0530 Subject: [PATCH 01/12] added backend integration and requisites Co-Authored-By: Deepanshubasera7 <203989045+Deepanshubasera7@users.noreply.github.com> --- docs/endpoint-agent/_category_.json | 2 +- docs/endpoint-agent/be/_category_.json | 11 ++ docs/endpoint-agent/be/architecture.md | 100 ++++++++++++++++++ docs/endpoint-agent/be/quick-start.md | 88 +++++++++++++++ .../endpoint-agent/requisites/_category_.json | 11 ++ .../endpoint-agent/requisites/architecture.md | 100 ++++++++++++++++++ docs/endpoint-agent/requisites/quick-start.md | 100 ++++++++++++++++++ static/llms.txt | 11 ++ 8 files changed, 422 insertions(+), 1 deletion(-) create mode 100644 docs/endpoint-agent/be/_category_.json create mode 100644 docs/endpoint-agent/be/architecture.md create mode 100644 docs/endpoint-agent/be/quick-start.md create mode 100644 docs/endpoint-agent/requisites/_category_.json create mode 100644 docs/endpoint-agent/requisites/architecture.md create mode 100644 docs/endpoint-agent/requisites/quick-start.md diff --git a/docs/endpoint-agent/_category_.json b/docs/endpoint-agent/_category_.json index a102cde..4e5feda 100644 --- a/docs/endpoint-agent/_category_.json +++ b/docs/endpoint-agent/_category_.json @@ -8,4 +8,4 @@ "customProps": { "icon": "Bot" } -} +} \ No newline at end of file diff --git a/docs/endpoint-agent/be/_category_.json b/docs/endpoint-agent/be/_category_.json new file mode 100644 index 0000000..7adfa1f --- /dev/null +++ b/docs/endpoint-agent/be/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "Backend Integration", + "position": 3, + "link": { + "type": "generated-index", + "description": "How the Sentinel endpoint agent connects to the Quilr backend: discovery sync, governance pull, and enforcement reporting." + }, + "customProps": { + "icon": "Link" + } +} diff --git a/docs/endpoint-agent/be/architecture.md b/docs/endpoint-agent/be/architecture.md new file mode 100644 index 0000000..537eaa1 --- /dev/null +++ b/docs/endpoint-agent/be/architecture.md @@ -0,0 +1,100 @@ +--- +sidebar_position: 2 +sidebar_custom_props: + icon: Layers +--- + +# Architecture + +How the Sentinel agent communicates with the Quilr backend: what it sends, what it receives, and when. + + + +## API Endpoints + +| Direction | Method | Description | +|-----------|--------|-------------| +| Agent → Backend | POST | Batch push discovered entities | +| Agent → Backend | POST | Per-decision enforcement audit log | +| Agent → Backend | POST | Block and quarantine alert notifications | +| Backend → Agent | GET | Governance overrides: approval status, execution policy | +| Backend → Agent | GET | Name-to-app mappings used by the Correlator | + +## Sync Cadence + +| Operation | Trigger | Frequency | +|-----------|---------|-----------| +| App ingest | New entities discovered | On discovery (startup + every 30 min) | +| Delta pull | Scheduled timer | Every 60 seconds | +| Activity report | Enforcement event | Immediate, fire-and-forget | +| Alert | Block / quarantine action | Immediate, fire-and-forget | + +## Authentication + +All requests include the following tenant-scoped headers: + +| Header | Value | +|--------|-------| +| `X-Tenant-ID` | Tenant UUID from the dashboard | +| `X-Subscriber-ID` | Subscriber identifier from the dashboard | + +These headers are set on every outbound request and are used by the backend for multi-tenant routing and isolation. + +## Local Persistence + +The agent maintains local state to ensure reliability across restarts and network outages. + +| Component | Format | Purpose | +|-----------|--------|---------| +| **Alert Queue** | SQLite | Buffers enforcement alerts when backend is offline. | +| **Entity Store** | JSON | Periodic snapshot of discovered apps and AI entities. | +| **Sync Cursor** | JSON | Persists the last-seen delta timestamp for incremental sync. | + +## Reliability + +| Feature | Behavior | +|---------|----------| +| **Ingest retries** | Retries on network failure; batches are idempotent. | +| **Offline Buffering** | Alerts are queued in the local SQLite DB and synced when connectivity returns. | +| **Delta cursor** | Persisted to disk before applying overrides; replays safely on restart. | +| **Activity / alerts** | Critical alerts are buffered; non-critical activity logs are fire-and-forget. | +| **Gzip compression** | All ingest payloads compressed to reduce bandwidth. | diff --git a/docs/endpoint-agent/be/quick-start.md b/docs/endpoint-agent/be/quick-start.md new file mode 100644 index 0000000..cdc9dcb --- /dev/null +++ b/docs/endpoint-agent/be/quick-start.md @@ -0,0 +1,88 @@ +--- +sidebar_position: 1 +sidebar_custom_props: + icon: Rocket +--- + +# Quick Start + +Get the Sentinel agent connected to the Quilr backend in 4 steps. + + + +## 1. Configure Backend Connection + +The agent reads its connection settings from the local configuration file in the data directory. Set these values before starting the agent: + +```toml +[backend] +base_url = "https://api.quilr.ai" +tenant_id = "" +subscriber_id = "" +``` + +| Field | Description | +|-------|-------------| +| `base_url` | Quilr backend API root | +| `tenant_id` | Your organization's tenant UUID | +| `subscriber_id` | Subscriber identifier from the Quilr dashboard | + +## 2. Verify Discovery Sync + +Once the agent starts, it pushes discovered apps to the backend automatically. Check the backend received them: + +- Go to **Applications** in the Quilr dashboard +- Discovered apps appear within the first polling cycle (startup + every 30 min) +- Each entity includes device ID, user, OS type, and canonical identity + +The agent batches up to 50 entities per request, compresses with gzip, and retries on failure. + +## 3. Confirm Governance Pull + +The agent polls for governance overrides every 60 seconds from `GET /ea/v1/sync/delta`. After setting a policy in the dashboard: + +- Policy changes reach the agent within the next poll cycle +- No agent restart needed +- The agent applies the override immediately to its in-memory EntityStore + +## 4. Check Activity Reporting + +Enforcement events (block, quarantine, justify) are reported to the backend as they happen: + +- **`/ea/v1/sync/activity`** : enforcement audit log per decision +- **`/ea/v1/sync/alerts`** : block and quarantine alerts for dashboard notifications + +Both are fire-and-forget. Critical alerts are buffered in a local SQLite database if the backend is unreachable and retried automatically. diff --git a/docs/endpoint-agent/requisites/_category_.json b/docs/endpoint-agent/requisites/_category_.json new file mode 100644 index 0000000..7d88970 --- /dev/null +++ b/docs/endpoint-agent/requisites/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "Requisites", + "position": 4, + "link": { + "type": "generated-index", + "description": "System requirements and prerequisites for deploying the Sentinel endpoint agent." + }, + "customProps": { + "icon": "ShieldCheck" + } +} diff --git a/docs/endpoint-agent/requisites/architecture.md b/docs/endpoint-agent/requisites/architecture.md new file mode 100644 index 0000000..c4bdf10 --- /dev/null +++ b/docs/endpoint-agent/requisites/architecture.md @@ -0,0 +1,100 @@ +--- +sidebar_position: 2 +sidebar_custom_props: + icon: Layers +--- + +# Architecture + +How system requirements map to agent components, and what each platform dependency is used for. + + + +## Component Dependency Map + +| Agent Component | macOS Requirement | Windows Requirement | +|----------------|-------------------|---------------------| +| **sentinel** (main agent) | root, signed binary | SYSTEM, Authenticode signed | +| **bootstrap** | root, signed binary | SYSTEM, Authenticode signed | +| **sentinel-proxy** | Network Extension entitlement, signed | WinDivert driver, signed | +| **SentinelProxyExtension** | System Extension approval | n/a | +| **ipc-light-broker** | Unix socket access | Named pipe access | +| **sentinel-diagnostics** | No special requirements | No special requirements | + +## Security Model + +The agent enforces a chain-of-trust before starting: + +1. **Bootstrap** verifies its own code signature using OS APIs +2. **Bootstrap** verifies the `sentinel` agent binary against the manifest +3. **Bootstrap** spawns `sentinel` with `--spawned-by-bootstrap` and passes its PID via `SENTINEL_BOOTSTRAP_PID` +4. **sentinel** rejects startup if not spawned by bootstrap (exits with code 1) + +This prevents the agent from running if tampered with or launched directly. + +## Installation Paths + +| Platform | Path | Contents | +|----------|------|----------| +| **macOS app bundle** | `/Applications/SentinelProxy.app/Contents/MacOS/` | All binaries | +| **macOS support dir** | `/Library/Application Support/Sentinel/` | Configs, certs, templates, logs | +| **macOS daemon** | `/Library/LaunchDaemons/com.sentinel.agent` | Service definition | +| **Windows binaries** | `C:\Program Files\Sentinel\` | All binaries | +| **Windows cert** | `C:\Program Files\Sentinel\cert` | Root CA | +| **Windows service** | `SentinelAgent` | Registered Windows Service | + +## Update Flow + +The agent self-updates via `sentinel-updater`, which the installer registers as a scheduled task or LaunchDaemon: + +1. Checks the CDN for a new version every 30 minutes +2. Downloads and verifies the package (RSA-PSS + SHA-256) +3. Validates signatures in staging before stopping the running agent +4. Deploys from staging, starts the agent, runs a 30-second health check +5. Rolls back automatically on failure + +The agent is never stopped until the staged package passes all verification checks. diff --git a/docs/endpoint-agent/requisites/quick-start.md b/docs/endpoint-agent/requisites/quick-start.md new file mode 100644 index 0000000..56fe7fe --- /dev/null +++ b/docs/endpoint-agent/requisites/quick-start.md @@ -0,0 +1,100 @@ +--- +sidebar_position: 1 +sidebar_custom_props: + icon: Rocket +--- + +# Quick Start + +Verify your endpoints meet the requirements before deploying the Sentinel agent. + + + +## OS Requirements + +| Platform | Minimum Version | Notes | +|----------|----------------|-------| +| **macOS** | 13.0 (Ventura) | Network Extension requires Ventura+ | +| **Windows** | 10 (1903+) or Server 2019 | WinDivert driver requires 64-bit | + +## Access Requirements + +| Platform | Required Access | Used For | +|----------|----------------|----------| +| **macOS** | `root` | LaunchDaemon, system extension install, keychain write | +| **Windows** | `SYSTEM` / Administrator | Windows Service, WinDivert driver, cert store write | + +The agent is deployed via MDM (Jamf, Intune, Kandji) or GPO. The installer handles service registration and cert trust automatically when run with `--trust-cert --register-as-service`. + +## Network Requirements + +The agent only makes outbound connections. No inbound ports are required. + +| Destination | Port | Purpose | +|-------------|------|---------| +| `api.quilr.ai` | 443 (HTTPS) | Backend sync: discovery, governance, activity | +| CDN (version check) | 443 (HTTPS) | Auto-updater version manifest and package download | + +If the endpoint routes through a corporate proxy, configure the proxy to pass through these destinations without TLS inspection of the agent's own traffic. + +## Platform-Specific Requirements + +### macOS + +| Requirement | Details | +|-------------|---------| +| **System Extension** | User must approve in System Settings > Privacy & Security after first install | +| **Network Extension entitlement** | Bundled in `sentinel-proxy` via provisioning profile | +| **Keychain write** | Required to trust the MITM root CA (`security add-trusted-cert`) | +| **File Descriptor limit** | Raised to 10,240 by installer (`ulimit -n`) | + +### Windows + +| Requirement | Details | +|-------------|---------| +| **WinDivert driver** | Bundled with the agent package | +| **Cert store write** | Required to trust the MITM root CA in the local machine store | +| **Windows Service** | Registered as `SentinelAgent`; runs as SYSTEM | +| **UAC** | Required for initial install; subsequent updates run as SYSTEM | + +## Disk Space + +| Component | Approximate Size | +|-----------|----------------| +| Agent binaries | ~50 MB | +| Dynamic cert + key | < 1 KB | +| Config and templates | < 5 MB | +| Logs (rolling) | Configurable; defaults to 100 MB cap | diff --git a/static/llms.txt b/static/llms.txt index 6b76573..e65efa3 100644 --- a/static/llms.txt +++ b/static/llms.txt @@ -47,7 +47,18 @@ ## Endpoint Agent +<<<<<<< Updated upstream - [Network Monitoring Quick Start](https://quilrai.github.io/docs/endpoint-agent/network-monitoring/quick-start): Set up Network Monitoring in 4 steps - install the Sentinel agent, enable traffic interception, configure DLP policies, and monitor activity. - [Network Monitoring Architecture](https://quilrai.github.io/docs/endpoint-agent/network-monitoring/architecture): Request processing pipeline - Intercept, Inspect, Scan, Enforce - with TLS MITM, DLP engine, and health monitoring. - [Process Mapping Quick Start](https://quilrai.github.io/docs/endpoint-agent/process-mapping/quick-start): Set up Process Mapping in 4 steps - deploy the System Monitor, review discovered applications, configure policies, and monitor activity. - [Process Mapping Architecture](https://quilrai.github.io/docs/endpoint-agent/process-mapping/architecture): Discovery and enforcement pipeline - Discover, Correlate, Sync, Enforce - covering process monitoring, Lua-based AI agent scanning, and governance. +======= +- [Network Monitoring Quick Start](https://docs.quilrai.dev/endpoint-agent/network-monitoring/quick-start.md): Set up Network Monitoring in 4 steps - install the Sentinel agent, enable traffic interception, configure DLP policies, and monitor activity. +- [Network Monitoring Architecture](https://docs.quilrai.dev/endpoint-agent/network-monitoring/architecture.md): Request processing pipeline - Intercept, Inspect, Scan, Enforce - with TLS MITM, DLP engine, and health monitoring. +- [Process Mapping Quick Start](https://docs.quilrai.dev/endpoint-agent/process-mapping/quick-start.md): Set up Process Mapping in 4 steps - deploy the System Monitor, review discovered applications, configure policies, and monitor activity. +- [Process Mapping Architecture](https://docs.quilrai.dev/endpoint-agent/process-mapping/architecture.md): Discovery and enforcement pipeline - Discover, Correlate, Sync, Enforce - covering process monitoring, Lua-based AI agent scanning, and governance. +- [Backend Integration Quick Start](https://docs.quilrai.dev/endpoint-agent/be/quick-start.md): Set up backend sync in 4 steps - configure connection, verify discovery, confirm governance pull, and check activity reporting. +- [Backend Integration Architecture](https://docs.quilrai.dev/endpoint-agent/be/architecture.md): Synchronization architecture - how the agent communicates with the Quilr backend via polling and event-driven reports, with local persistence and reliability layers. +- [Requisites Quick Start](https://docs.quilrai.dev/endpoint-agent/requisites/quick-start.md): Verify endpoint readiness in 4 steps - check OS support, access rights, network requirements, and platform-specific drivers. +- [Requisites Architecture](https://docs.quilrai.dev/endpoint-agent/requisites/architecture.md): Platform dependency map - how the agent's core, network monitor, and certificate management interact with macOS and Windows system internals. +>>>>>>> Stashed changes From 736e1ca6da49ac30b5962d136c881786b2648d0c Mon Sep 17 00:00:00 2001 From: Shyamquilr Date: Thu, 9 Apr 2026 12:39:34 +0530 Subject: [PATCH 02/12] Update llms.txt --- static/llms.txt | 71 +++++++++++++++++++++++-------------------------- 1 file changed, 34 insertions(+), 37 deletions(-) diff --git a/static/llms.txt b/static/llms.txt index e65efa3..be1f5a5 100644 --- a/static/llms.txt +++ b/static/llms.txt @@ -4,61 +4,58 @@ ## LLM Gateway -- [Quick Start](https://quilrai.github.io/docs/llm-gateway/quick-start): Set up the LLM Gateway in 4 steps - create an app, add a provider key, configure guardrails, and connect your application. -- [Architecture](https://quilrai.github.io/docs/llm-gateway/architecture): Request processing pipeline - Validate, Scan, Transform, Route - with a visual diagram of every stage. -- [Integration Guide](https://quilrai.github.io/docs/llm-gateway/integration-guide): Endpoint URLs, authentication setup, and code examples for connecting your app to the gateway. -- [Provider Support](https://quilrai.github.io/docs/llm-gateway/provider-support): Supported LLM providers (OpenAI, Anthropic, Azure, Bedrock, Vertex AI) and their capability matrix. -- [UX Changelog](https://quilrai.github.io/docs/llm-gateway/ux-changelog): Recent interface improvements - tagging, filtering, and quality-of-life updates. +Connect to any LLM provider — OpenAI, Anthropic, Azure, Bedrock, Vertex AI — through a single API key. Route traffic across multiple providers with weighted load balancing and automatic failover, with zero code changes in your application. + +- [Quick Start](https://docs.quilrai.dev/llm-gateway/quick-start.md): Set up the LLM Gateway in 4 steps - create an app, add a provider key, configure guardrails, and connect your application. +- [Architecture](https://docs.quilrai.dev/llm-gateway/architecture.md): Request processing pipeline - Validate, Scan, Transform, Route - with a visual diagram of every stage. +- [Integration Guide](https://docs.quilrai.dev/llm-gateway/integration-guide.md): Endpoint URLs, authentication setup, and code examples for connecting your app to the gateway. +- [Provider Support](https://docs.quilrai.dev/llm-gateway/provider-support.md): Supported LLM providers (OpenAI, Anthropic, Azure, Bedrock, Vertex AI) and their capability matrix. +- [HA & SLA](https://docs.quilrai.dev/llm-gateway/ha-and-sla.md): Regional endpoints, recommended retry strategy, connection pooling, and 99.6% uptime SLA. +- [UX Changelog](https://docs.quilrai.dev/llm-gateway/ux-changelog.md): Recent interface improvements - tagging, filtering, and quality-of-life updates. ### LLM Gateway Features -- [Request Routing](https://quilrai.github.io/docs/llm-gateway/features/request-routing): Multi-provider load balancing and automatic failover behind a single API key. -- [Token Saving](https://quilrai.github.io/docs/llm-gateway/features/token-saving): Reduce input token usage by compressing JSON and stripping HTML/Markdown automatically. -- [Security Guardrails](https://quilrai.github.io/docs/llm-gateway/features/security-guardrails): Detect and act on PII, PHI, PCI, financial data, and adversarial inputs in requests and responses. -- [Custom Intents](https://quilrai.github.io/docs/llm-gateway/features/custom-intents): Define your own detection categories trained with positive and negative examples. -- [Rate Limits](https://quilrai.github.io/docs/llm-gateway/features/rate-limits): Control request rates, token budgets, and API key expiration. -- [Prompt Store](https://quilrai.github.io/docs/llm-gateway/features/prompt-store): Manage and version system prompts centrally with template variable substitution. -- [Red Team Testing](https://quilrai.github.io/docs/llm-gateway/features/red-team-testing): Test guardrails configuration against adversarial prompts. -- [Identity Aware](https://quilrai.github.io/docs/llm-gateway/features/identity-aware): Authenticate and track individual users behind each API key via JWT/JWKS or header validation. +- [Request Routing](https://docs.quilrai.dev/llm-gateway/features/request-routing.md): Weight-based load balancing across multiple providers and models, with automatic failover when a provider goes down — all behind a single API key. +- [Token Saving](https://docs.quilrai.dev/llm-gateway/features/token-saving.md): Reduce input token usage by compressing JSON and stripping HTML/Markdown automatically. +- [Security Guardrails](https://docs.quilrai.dev/llm-gateway/features/security-guardrails.md): Detect and act on PII, PHI, PCI, financial data, and adversarial inputs in requests and responses. +- [Custom Intents](https://docs.quilrai.dev/llm-gateway/features/custom-intents.md): Define your own detection categories trained with positive and negative examples. +- [Rate Limits](https://docs.quilrai.dev/llm-gateway/features/rate-limits.md): Control request rates, token budgets, and API key expiration. +- [Prompt Store](https://docs.quilrai.dev/llm-gateway/features/prompt-store.md): Manage and version system prompts centrally with template variable substitution. +- [Red Team Testing](https://docs.quilrai.dev/llm-gateway/features/red-team-testing.md): Test guardrails configuration against adversarial prompts. +- [Identity Aware](https://docs.quilrai.dev/llm-gateway/features/identity-aware.md): Authenticate and track individual users behind each API key via JWT/JWKS or header validation. +- [SDK Mode](https://docs.quilrai.dev/llm-gateway/features/sdk-mode.md): Scan content directly from your application code — no LLM proxy required. ## MCP Gateway -- [Quick Start](https://quilrai.github.io/docs/mcp-gateway/quick-start): Set up the MCP Gateway in 4 steps - add an MCP, configure tools and guardrails, connect an agent, and monitor. -- [Architecture](https://quilrai.github.io/docs/mcp-gateway/architecture): Tool call processing pipeline - Authenticate, Authorize, Scan, Policy, Connect - with auth mediation details. -- [Integration Guide](https://quilrai.github.io/docs/mcp-gateway/integration-guide): MCP endpoint URLs, authentication methods (Bearer token, OAuth DCR, OAuth manual), and connection examples. +- [Quick Start](https://docs.quilrai.dev/mcp-gateway/quick-start.md): Set up the MCP Gateway in 4 steps - add an MCP, configure tools and guardrails, connect an agent, and monitor. +- [Architecture](https://docs.quilrai.dev/mcp-gateway/architecture.md): Tool call processing pipeline - Authenticate, Authorize, Scan, Policy, Connect - with auth mediation details. +- [Integration Guide](https://docs.quilrai.dev/mcp-gateway/integration-guide.md): MCP endpoint URLs, authentication methods (Bearer token, OAuth DCR, OAuth manual), and connection examples. ### MCP Gateway Features -- [MCP Library](https://quilrai.github.io/docs/mcp-gateway/features/mcp-library): One-click install pre-built MCP integrations from the catalog across productivity, developer tools, and more. -- [Tools Management](https://quilrai.github.io/docs/mcp-gateway/features/tools-management): Control which MCP tools are available to agents, organized by risk level (read, write, destructive). -- [Agents Configuration](https://quilrai.github.io/docs/mcp-gateway/features/agents-configuration): Map AI agents to MCPs, manage per-agent permissions, and monitor usage statistics. -- [Security Guardrails](https://quilrai.github.io/docs/mcp-gateway/features/security-guardrails): Detect sensitive data (PII, PHI, PCI) and adversarial attacks in MCP tool call inputs and outputs. -- [Access Control](https://quilrai.github.io/docs/mcp-gateway/features/access-control): Restrict which AI agents can use each MCP server via User-Agent header matching. -- [API Tokens](https://quilrai.github.io/docs/mcp-gateway/features/api-tokens): Generate and manage Bearer tokens scoped to specific agents for programmatic MCP access. -- [OAuth Connect](https://quilrai.github.io/docs/mcp-gateway/features/oauth-connect): Authorize OAuth-protected MCP servers with one click via Dynamic Client Registration or manual credentials. -- [Web Search Policy](https://quilrai.github.io/docs/mcp-gateway/features/web-search-policy): Filter web search domains using enterprise security gateway rules (Zscaler ZIA, Prisma Access, FortiGate, Cisco Umbrella). +- [MCP Library](https://docs.quilrai.dev/mcp-gateway/features/mcp-library.md): One-click install pre-built MCP integrations from the catalog across productivity, developer tools, and more. +- [Tools Management](https://docs.quilrai.dev/mcp-gateway/features/tools-management.md): Control which MCP tools are available to agents, organized by risk level (read, write, destructive). +- [Agents Configuration](https://docs.quilrai.dev/mcp-gateway/features/agents-configuration.md): Map AI agents to MCPs, manage per-agent permissions, and monitor usage statistics. +- [Security Guardrails](https://docs.quilrai.dev/mcp-gateway/features/security-guardrails.md): Detect sensitive data (PII, PHI, PCI) and adversarial attacks in MCP tool call inputs and outputs. +- [Access Control](https://docs.quilrai.dev/mcp-gateway/features/access-control.md): Restrict which AI agents can use each MCP server via User-Agent header matching. +- [API Tokens](https://docs.quilrai.dev/mcp-gateway/features/api-tokens.md): Generate and manage Bearer tokens scoped to specific agents for programmatic MCP access. +- [OAuth Connect](https://docs.quilrai.dev/mcp-gateway/features/oauth-connect.md): Authorize OAuth-protected MCP servers with one click via Dynamic Client Registration or manual credentials. +- [Web Search Policy](https://docs.quilrai.dev/mcp-gateway/features/web-search-policy.md): Filter web search domains using enterprise security gateway rules (Zscaler ZIA, Prisma Access, FortiGate, Cisco Umbrella). ## Compliance API Integration ### Claude -- [Overview](https://quilrai.github.io/docs/compliance-api-integration/claude/overview): Connect to Anthropic's Compliance API to monitor Claude.ai usage - sync organizations, users, chats, projects, and activities, with automatic DLP scanning of all user inputs. -- [Key Management](https://quilrai.github.io/docs/compliance-api-integration/claude/key-management): Register, monitor, and revoke Compliance API keys - keys are validated on registration, stored encrypted, and drive continuous sync and DLP passes. +- [Overview](https://docs.quilrai.dev/compliance-api-integration/claude/overview.md): Connect to Anthropic's Compliance API to monitor Claude.ai usage - sync organizations, users, chats, projects, and activities, with automatic DLP scanning of all user inputs. +- [Key Management](https://docs.quilrai.dev/compliance-api-integration/claude/key-management.md): Register, monitor, and revoke Compliance API keys - keys are validated on registration, stored encrypted, and drive continuous sync and DLP passes. ## Endpoint Agent -<<<<<<< Updated upstream -- [Network Monitoring Quick Start](https://quilrai.github.io/docs/endpoint-agent/network-monitoring/quick-start): Set up Network Monitoring in 4 steps - install the Sentinel agent, enable traffic interception, configure DLP policies, and monitor activity. -- [Network Monitoring Architecture](https://quilrai.github.io/docs/endpoint-agent/network-monitoring/architecture): Request processing pipeline - Intercept, Inspect, Scan, Enforce - with TLS MITM, DLP engine, and health monitoring. -- [Process Mapping Quick Start](https://quilrai.github.io/docs/endpoint-agent/process-mapping/quick-start): Set up Process Mapping in 4 steps - deploy the System Monitor, review discovered applications, configure policies, and monitor activity. -- [Process Mapping Architecture](https://quilrai.github.io/docs/endpoint-agent/process-mapping/architecture): Discovery and enforcement pipeline - Discover, Correlate, Sync, Enforce - covering process monitoring, Lua-based AI agent scanning, and governance. -======= - [Network Monitoring Quick Start](https://docs.quilrai.dev/endpoint-agent/network-monitoring/quick-start.md): Set up Network Monitoring in 4 steps - install the Sentinel agent, enable traffic interception, configure DLP policies, and monitor activity. - [Network Monitoring Architecture](https://docs.quilrai.dev/endpoint-agent/network-monitoring/architecture.md): Request processing pipeline - Intercept, Inspect, Scan, Enforce - with TLS MITM, DLP engine, and health monitoring. - [Process Mapping Quick Start](https://docs.quilrai.dev/endpoint-agent/process-mapping/quick-start.md): Set up Process Mapping in 4 steps - deploy the System Monitor, review discovered applications, configure policies, and monitor activity. - [Process Mapping Architecture](https://docs.quilrai.dev/endpoint-agent/process-mapping/architecture.md): Discovery and enforcement pipeline - Discover, Correlate, Sync, Enforce - covering process monitoring, Lua-based AI agent scanning, and governance. -- [Backend Integration Quick Start](https://docs.quilrai.dev/endpoint-agent/be/quick-start.md): Set up backend sync in 4 steps - configure connection, verify discovery, confirm governance pull, and check activity reporting. -- [Backend Integration Architecture](https://docs.quilrai.dev/endpoint-agent/be/architecture.md): Synchronization architecture - how the agent communicates with the Quilr backend via polling and event-driven reports, with local persistence and reliability layers. -- [Requisites Quick Start](https://docs.quilrai.dev/endpoint-agent/requisites/quick-start.md): Verify endpoint readiness in 4 steps - check OS support, access rights, network requirements, and platform-specific drivers. -- [Requisites Architecture](https://docs.quilrai.dev/endpoint-agent/requisites/architecture.md): Platform dependency map - how the agent's core, network monitor, and certificate management interact with macOS and Windows system internals. ->>>>>>> Stashed changes +- [Backend Integration Quick Start](https://quilrai.github.io/docs/endpoint-agent/be/quick-start): Set up backend sync in 4 steps - configure connection, verify discovery, confirm governance pull, and check activity reporting. +- [Backend Integration Architecture](https://quilrai.github.io/docs/endpoint-agent/be/architecture): Synchronization architecture - how the agent communicates with the Quilr backend via polling and event-driven reports, with local persistence and reliability layers. +- [Requisites Quick Start](https://quilrai.github.io/docs/endpoint-agent/requisites/quick-start): Verify endpoint readiness in 4 steps - check OS support, access rights, network requirements, and platform-specific drivers. +- [Requisites Architecture](https://quilrai.github.io/docs/endpoint-agent/requisites/architecture): Platform dependency map - how the agent's core, network monitor, and certificate management interact with macOS and Windows system internals. From 93d774bad9c0c35df3350fb6884093483f0ae5c2 Mon Sep 17 00:00:00 2001 From: Deepanshubasera7 Date: Thu, 9 Apr 2026 12:41:03 +0530 Subject: [PATCH 03/12] Revise quick-start.md for clarity and updates Updated quick-start guide to clarify API endpoints and configuration. --- docs/endpoint-agent/be/quick-start.md | 31 ++++++++++++++------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/docs/endpoint-agent/be/quick-start.md b/docs/endpoint-agent/be/quick-start.md index cdc9dcb..1b36bc0 100644 --- a/docs/endpoint-agent/be/quick-start.md +++ b/docs/endpoint-agent/be/quick-start.md @@ -20,24 +20,24 @@ Get the Sentinel agent connected to the Quilr backend in 4 steps. { label: "Sync Apps", items: [ - "POST /ea/v1/sync/discovered-apps", + "Auto-push on startup", "Batches of 50, gzip-compressed", - "202 Accepted on success", + "Visible in Applications tab", ], }, { label: "Pull Governance", items: [ - "GET /ea/v1/sync/delta", - "Polls every 60s", + "Delta sync every 60s", + "No agent restart needed", "Approval status + policy", ], }, { label: "Report Activity", items: [ - "POST /ea/v1/sync/activity", - "POST /ea/v1/sync/alerts", + "Enforcement audit log", + "Block & quarantine alerts", "Fire-and-forget", ], }, @@ -47,18 +47,19 @@ Get the Sentinel agent connected to the Quilr backend in 4 steps. The agent reads its connection settings from the local configuration file in the data directory. Set these values before starting the agent: -```toml +```toml title="sentinel.toml" [backend] +# Quilr backend API root base_url = "https://api.quilr.ai" + +# Your organization's tenant UUID — find it in Settings → Organization tenant_id = "" + +# Subscriber identifier — find it in Settings → Subscribers subscriber_id = "" ``` -| Field | Description | -|-------|-------------| -| `base_url` | Quilr backend API root | -| `tenant_id` | Your organization's tenant UUID | -| `subscriber_id` | Subscriber identifier from the Quilr dashboard | +Replace the placeholder values with your credentials from the **Quilr dashboard**. ## 2. Verify Discovery Sync @@ -72,7 +73,7 @@ The agent batches up to 50 entities per request, compresses with gzip, and retri ## 3. Confirm Governance Pull -The agent polls for governance overrides every 60 seconds from `GET /ea/v1/sync/delta`. After setting a policy in the dashboard: +The agent polls for governance overrides every 60 seconds via [delta sync](./architecture#api-endpoints). After setting a policy in the dashboard: - Policy changes reach the agent within the next poll cycle - No agent restart needed @@ -82,7 +83,7 @@ The agent polls for governance overrides every 60 seconds from `GET /ea/v1/sync/ Enforcement events (block, quarantine, justify) are reported to the backend as they happen: -- **`/ea/v1/sync/activity`** : enforcement audit log per decision -- **`/ea/v1/sync/alerts`** : block and quarantine alerts for dashboard notifications +- **Activity sync** : enforcement audit log per decision +- **Alert sync** : block and quarantine alerts for dashboard notifications Both are fire-and-forget. Critical alerts are buffered in a local SQLite database if the backend is unreachable and retried automatically. From 9d919a65ba6af01b737f3049359c459b54183e3c Mon Sep 17 00:00:00 2001 From: Deepanshubasera7 Date: Thu, 9 Apr 2026 12:43:51 +0530 Subject: [PATCH 04/12] updated llms.txt --- static/llms.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/static/llms.txt b/static/llms.txt index be1f5a5..8b672dc 100644 --- a/static/llms.txt +++ b/static/llms.txt @@ -55,7 +55,7 @@ Connect to any LLM provider — OpenAI, Anthropic, Azure, Bedrock, Vertex AI — - [Network Monitoring Architecture](https://docs.quilrai.dev/endpoint-agent/network-monitoring/architecture.md): Request processing pipeline - Intercept, Inspect, Scan, Enforce - with TLS MITM, DLP engine, and health monitoring. - [Process Mapping Quick Start](https://docs.quilrai.dev/endpoint-agent/process-mapping/quick-start.md): Set up Process Mapping in 4 steps - deploy the System Monitor, review discovered applications, configure policies, and monitor activity. - [Process Mapping Architecture](https://docs.quilrai.dev/endpoint-agent/process-mapping/architecture.md): Discovery and enforcement pipeline - Discover, Correlate, Sync, Enforce - covering process monitoring, Lua-based AI agent scanning, and governance. -- [Backend Integration Quick Start](https://quilrai.github.io/docs/endpoint-agent/be/quick-start): Set up backend sync in 4 steps - configure connection, verify discovery, confirm governance pull, and check activity reporting. -- [Backend Integration Architecture](https://quilrai.github.io/docs/endpoint-agent/be/architecture): Synchronization architecture - how the agent communicates with the Quilr backend via polling and event-driven reports, with local persistence and reliability layers. -- [Requisites Quick Start](https://quilrai.github.io/docs/endpoint-agent/requisites/quick-start): Verify endpoint readiness in 4 steps - check OS support, access rights, network requirements, and platform-specific drivers. -- [Requisites Architecture](https://quilrai.github.io/docs/endpoint-agent/requisites/architecture): Platform dependency map - how the agent's core, network monitor, and certificate management interact with macOS and Windows system internals. +- [Backend Integration Quick Start](https://docs.quilrai.dev/endpoint-agent/be/quick-start.md): Set up backend sync in 4 steps - configure connection, verify discovery, confirm governance pull, and check activity reporting. +- [Backend Integration Architecture](https://docs.quilrai.dev/endpoint-agent/be/architecture.md): Synchronization architecture - how the agent communicates with the Quilr backend via polling and event-driven reports, with local persistence and reliability layers. +- [Requisites Quick Start](https://docs.quilrai.dev/endpoint-agent/requisites/quick-start.md): Verify endpoint readiness in 4 steps - check OS support, access rights, network requirements, and platform-specific drivers. +- [Requisites Architecture](https://docs.quilrai.dev/endpoint-agent/requisites/architecture.md): Platform dependency map - how the agent's core, network monitor, and certificate management interact with macOS and Windows system internals. From ecb0054cd8887292009d14607b760db1a0cbd821 Mon Sep 17 00:00:00 2001 From: Deepanshubasera7 Date: Thu, 9 Apr 2026 12:52:23 +0530 Subject: [PATCH 05/12] Enhance quick-start.md with configuration details Updated the quick-start guide to include a table for configuration fields and descriptions. --- docs/endpoint-agent/be/quick-start.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/endpoint-agent/be/quick-start.md b/docs/endpoint-agent/be/quick-start.md index 1b36bc0..f6e2f61 100644 --- a/docs/endpoint-agent/be/quick-start.md +++ b/docs/endpoint-agent/be/quick-start.md @@ -47,17 +47,18 @@ Get the Sentinel agent connected to the Quilr backend in 4 steps. The agent reads its connection settings from the local configuration file in the data directory. Set these values before starting the agent: -```toml title="sentinel.toml" +```toml [backend] -# Quilr backend API root base_url = "https://api.quilr.ai" - -# Your organization's tenant UUID — find it in Settings → Organization tenant_id = "" - -# Subscriber identifier — find it in Settings → Subscribers subscriber_id = "" ``` + +| Field | Description | +|-------|-------------| +| `base_url` | Quilr backend API root | +| `tenant_id` | Your organization's tenant UUID | +| `subscriber_id` | Subscriber identifier from the Quilr dashboard | Replace the placeholder values with your credentials from the **Quilr dashboard**. From f5d945043ea897edec2a58a7f9cb895e757f8062 Mon Sep 17 00:00:00 2001 From: Adarsh Agarwal Date: Sun, 19 Apr 2026 02:25:50 +0530 Subject: [PATCH 06/12] integrate browser agent --- docs/browser-agent/_category_.json | 11 +++ docs/browser-agent/clipboard/_category_.json | 11 +++ docs/browser-agent/clipboard/architecture.md | 82 +++++++++++++++ docs/browser-agent/clipboard/quick-start.md | 92 +++++++++++++++++ docs/browser-agent/indexing/_category_.json | 11 +++ docs/browser-agent/indexing/architecture.md | 94 ++++++++++++++++++ docs/browser-agent/indexing/quick-start.md | 89 +++++++++++++++++ .../browser-agent/kill-switch/_category_.json | 11 +++ .../browser-agent/kill-switch/architecture.md | 81 +++++++++++++++ docs/browser-agent/kill-switch/quick-start.md | 80 +++++++++++++++ .../kill-switch/_category_.json | 11 +++ .../kill-switch/architecture.md | 85 ++++++++++++++++ .../endpoint-agent/kill-switch/quick-start.md | 99 +++++++++++++++++++ 13 files changed, 757 insertions(+) create mode 100644 docs/browser-agent/_category_.json create mode 100644 docs/browser-agent/clipboard/_category_.json create mode 100644 docs/browser-agent/clipboard/architecture.md create mode 100644 docs/browser-agent/clipboard/quick-start.md create mode 100644 docs/browser-agent/indexing/_category_.json create mode 100644 docs/browser-agent/indexing/architecture.md create mode 100644 docs/browser-agent/indexing/quick-start.md create mode 100644 docs/browser-agent/kill-switch/_category_.json create mode 100644 docs/browser-agent/kill-switch/architecture.md create mode 100644 docs/browser-agent/kill-switch/quick-start.md create mode 100644 docs/endpoint-agent/kill-switch/_category_.json create mode 100644 docs/endpoint-agent/kill-switch/architecture.md create mode 100644 docs/endpoint-agent/kill-switch/quick-start.md diff --git a/docs/browser-agent/_category_.json b/docs/browser-agent/_category_.json new file mode 100644 index 0000000..e959501 --- /dev/null +++ b/docs/browser-agent/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "Browser Agent", + "position": 5, + "link": { + "type": "generated-index", + "description": "Browser extension capabilities for DLP policy enforcement, clipboard monitoring, file indexing configuration, and agent lifecycle control." + }, + "customProps": { + "icon": "Globe" + } +} diff --git a/docs/browser-agent/clipboard/_category_.json b/docs/browser-agent/clipboard/_category_.json new file mode 100644 index 0000000..7b54051 --- /dev/null +++ b/docs/browser-agent/clipboard/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "Clipboard Monitor", + "position": 1, + "link": { + "type": "generated-index", + "description": "Intercept OS clipboard copy events, forward content metadata to the browser extension policy engine, and enforce allow, block, or prompt decisions in real time." + }, + "customProps": { + "icon": "Clipboard" + } +} diff --git a/docs/browser-agent/clipboard/architecture.md b/docs/browser-agent/clipboard/architecture.md new file mode 100644 index 0000000..3fa2c5c --- /dev/null +++ b/docs/browser-agent/clipboard/architecture.md @@ -0,0 +1,82 @@ +--- +sidebar_position: 2 +sidebar_custom_props: + icon: Layers +--- + +# Architecture + +How the QuilrAI Clipboard Monitor intercepts clipboard events on the endpoint, enforces DLP policies from the browser extension, and takes action without interrupting the user. + + + +## Pipeline Stages + +Every clipboard event flows through these stages in order. Each stage is independently configurable from the dashboard. + +| Stage | Description | +|-------|-------------| +| **OS Hook** | Intercepts native clipboard-change notifications on Windows and macOS. | +| **Filter** | Suppresses events within the debounce window and applies content-type gates and payload size cap. | +| **Forward to Extension** | Sends content metadata to the browser extension over the Native Messaging pipe for policy evaluation. | +| **Policy Evaluation** | The extension evaluates DLP rules against the clipboard payload and returns Allow, Block, or Prompt. | +| **Enforce** | The endpoint executes the decision — clears clipboard on block, shows a native dialog on prompt. | + +## Response Path + +Policy decisions from the browser extension flow back through the **enforcement layer** before any action is taken. The same DLP rule set applies to all content types (text, files, images). + +## Platform Support + +| Platform | Hook Mechanism | Justification UI | +|----------|---------------|-----------------| +| **macOS** | NSPasteboard change-count polling | Native Cocoa dialog | +| **Windows** | WinAPI clipboard-change notification | Windows message-based dialog | + +macOS requires **Accessibility permission** for the Sentinel process. + +## Observability + +Every clipboard event is logged with content type, policy decision, and enforcement outcome. Check **Logs under Clipboard Monitor** to review activity. diff --git a/docs/browser-agent/clipboard/quick-start.md b/docs/browser-agent/clipboard/quick-start.md new file mode 100644 index 0000000..ab6da83 --- /dev/null +++ b/docs/browser-agent/clipboard/quick-start.md @@ -0,0 +1,92 @@ +--- +sidebar_position: 1 +sidebar_custom_props: + icon: Rocket +--- + +# Quick Start + +Get up and running with Clipboard Monitoring in 4 steps. + + + +## 1. Enable the Monitor + +The clipboard monitor runs as part of the Sentinel endpoint agent and starts automatically on deployment. + +| Platform | Requirement | +|----------|------------| +| **macOS** | Grant **Accessibility permission** to the Sentinel process in System Settings → Privacy & Security | +| **Windows** | No additional permissions required | + +Deploy the Sentinel agent via MDM or GPO. The clipboard monitor activates immediately. + +## 2. Choose Content Types + +Navigate to **Clipboard Monitor → Settings** in the dashboard to configure which clipboard operations to intercept. + +| Setting | Default | Description | +|---------|---------|-------------| +| **Monitor text** | On | Captures plain text and rich-text clipboard copies | +| **Monitor files** | Off | Captures file-path clipboard events | +| **Monitor images** | Off | Captures image clipboard events | +| **Debounce window** | 100 ms | Suppresses repeated events within this window | +| **Max payload size** | 10 KB | Payload forwarded to the extension is capped at this size | + +Changes are pushed to the endpoint agent and take effect on the next agent restart. + +## 3. Set DLP Policies + +Define rules in the browser extension under **DLP Policies → Clipboard**. Rules match on content category, size, or custom regex patterns. + +| Action | What Happens | +|--------|-------------| +| **Allow** | Clipboard operation completes silently; event is logged | +| **Block** | Endpoint clears the clipboard; user is notified | +| **Prompt** | Native OS dialog asks the user for a justification before continuing | + +## 4. Monitor Events + +Check **Logs under Clipboard Monitor** to verify events are flowing and policies are being enforced. + +- **Event volume**: clipboard events detected and forwarded per hour +- **Policy decisions**: allow, block, and prompt counts by content type +- **Justification text**: user responses to prompted events +- **Enforcement outcomes**: confirmation of block and clear actions on the endpoint + +--- + +**Next step:** See the [Architecture](./architecture) for the full detection and enforcement pipeline. diff --git a/docs/browser-agent/indexing/_category_.json b/docs/browser-agent/indexing/_category_.json new file mode 100644 index 0000000..f47d86e --- /dev/null +++ b/docs/browser-agent/indexing/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "File Indexing", + "position": 2, + "link": { + "type": "generated-index", + "description": "Configure and manage the endpoint file index from the browser extension. Drives DLP file-path resolution for upload and download scanning." + }, + "customProps": { + "icon": "Database" + } +} diff --git a/docs/browser-agent/indexing/architecture.md b/docs/browser-agent/indexing/architecture.md new file mode 100644 index 0000000..58985a4 --- /dev/null +++ b/docs/browser-agent/indexing/architecture.md @@ -0,0 +1,94 @@ +--- +sidebar_position: 2 +sidebar_custom_props: + icon: Layers +--- + +# Architecture + +How the QuilrAI File Indexer builds and maintains a local filesystem index on the endpoint, driven by configuration from the dashboard, to resolve file paths for DLP scanning. + + + +## Pipeline Stages + +Every index operation flows through these stages. Each stage is independently configurable from the dashboard. + +| Stage | Description | +|-------|-------------| +| **Config Push** | Dashboard pushes root paths, ignore rules, and scan interval to the endpoint agent. Triggers an immediate re-scan on receipt. | +| **Mount Policy** | Evaluates each root path before scanning. Excludes network shares, Windows UNC paths, and macOS mounted disk images automatically. | +| **Full Scan** | A parallel directory walker traverses configured paths at reduced OS thread priority. Results are batch-written to a local SQLite index. | +| **Safety Guards** | Three-level protection: soft limit reduces scan depth near the file ceiling; hard limit prunes the deepest paths after a scan; a 30-minute timeout prevents data loss on partial scans. | +| **Real-time Watcher** | Listens for filesystem changes using OS-native APIs and applies incremental updates in 300 ms batched transactions. | +| **File Search** | Resolves file paths for DLP in two phases: fast index lookup by filename, followed by disk verification of size and modification time. | + +## Scheduling + +| Trigger | Default | Description | +|---------|---------|-------------| +| **Config push** | Immediate | Fires on every dashboard configuration update | +| **Scheduled scan** | Every 60 min | Periodic full re-scan to catch changes missed by the watcher | +| **Agent start** | On startup | Ensures the index is current on every (re-)start | + +## Platform Support + +| Platform | Directory Scan | File Watcher | +|----------|---------------|-------------| +| **macOS** | Parallel walker at background priority | FSEvents | +| **Windows** | Parallel walker at below-normal thread priority | ReadDirectoryChangesW | + +## Observability + +Index state and scan history are available from the dashboard under **File Index Status**. + +- **Scan status**: Idle / Running / Failed with last-run timestamp and duration +- **File count**: total indexed files and any paths pruned by safety limits +- **Watcher activity**: create, modify, and delete event counts +- **Search performance**: index hit rate vs. disk-verification fallback rate diff --git a/docs/browser-agent/indexing/quick-start.md b/docs/browser-agent/indexing/quick-start.md new file mode 100644 index 0000000..9666b6f --- /dev/null +++ b/docs/browser-agent/indexing/quick-start.md @@ -0,0 +1,89 @@ +--- +sidebar_position: 1 +sidebar_custom_props: + icon: Rocket +--- + +# Quick Start + +Get up and running with File Indexing in 4 steps. + + + +## 1. Configure Index Paths + +Go to **File Indexing → Settings** in the dashboard and set the paths and rules for the endpoint. + +| Setting | Description | +|---------|-------------| +| **Root paths** | Directories to index. Supports macOS and Windows paths. | +| **Ignore patterns** | gitignore-style globs for paths to exclude (e.g. `**/node_modules/**`, `**/.git/**`, `*.tmp`). | +| **Scan interval** | How often a full re-scan runs. Default is 60 minutes. | +| **Max files** | Ceiling for total indexed files. Safety limits apply automatically when approached. | + +Network shares, UNC paths, and macOS disk images are excluded automatically — no configuration needed. + +## 2. Trigger the Initial Scan + +A scan is triggered automatically when: +- A configuration update is pushed from the dashboard +- The Sentinel agent starts or restarts + +The scan runs at reduced OS priority so it does not affect endpoint performance. Navigate to **File Index Status** to track progress. + +## 3. Enable Real-time Watching + +The file watcher runs continuously alongside scheduled scans, keeping the index current between full sweeps. + +| Platform | OS API | +|----------|--------| +| **macOS** | FSEvents | +| **Windows** | ReadDirectoryChangesW | + +Filesystem changes are collected in 300 ms windows and written to the index in a single atomic operation. No additional configuration is required — the watcher starts automatically with the indexing service. + +## 4. Monitor Index Health + +Check **File Index Status** in the dashboard to confirm the index is healthy and up to date. + +- **Scan status**: Idle / Running / Failed with last-run timestamp +- **File count**: total indexed paths and any pruned by safety limits +- **Watcher events**: create, modify, and delete counts per hour +- **Search hit rate**: how often DLP file resolution hits the index vs. falls back to disk + +--- + +**Next step:** See the [Architecture](./architecture) for full scan, watch, and search pipeline details. diff --git a/docs/browser-agent/kill-switch/_category_.json b/docs/browser-agent/kill-switch/_category_.json new file mode 100644 index 0000000..2aed72b --- /dev/null +++ b/docs/browser-agent/kill-switch/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "Kill Switch", + "position": 3, + "link": { + "type": "generated-index", + "description": "Remotely disable or re-enable the Sentinel endpoint agent from the browser extension. State is persisted across restarts; the re-enable channel is preserved at all times." + }, + "customProps": { + "icon": "Shield" + } +} diff --git a/docs/browser-agent/kill-switch/architecture.md b/docs/browser-agent/kill-switch/architecture.md new file mode 100644 index 0000000..e3793e4 --- /dev/null +++ b/docs/browser-agent/kill-switch/architecture.md @@ -0,0 +1,81 @@ +--- +sidebar_position: 2 +sidebar_custom_props: + icon: Layers +--- + +# Architecture + +How the browser extension disables and re-enables the Sentinel endpoint agent at runtime — without a process restart, with state persisted across reboots. + + + +## Pipeline Stages + +Every kill switch transition flows through these stages in order. + +| Stage | Description | +|-------|-------------| +| **Native Messaging** | The extension sends `{ "disable_agent": true }` or `{ "disable_agent": false }` over the Native Messaging pipe to the Sentinel agent. | +| **State Storage** | The agent persists the flag to its local database immediately. The state is restored on every subsequent startup — no re-disable needed after a reboot. | +| **Kill** | All DLP event chains are removed from the event broker and all services (clipboard monitor, file indexer) are stopped. The re-enable chain remains active. | +| **Revive** | All DLP event chains are restored and all services are restarted. The agent resumes full operation without a process restart. | + +## Always-On Re-enable + +One channel is never removed, even when the agent is fully disabled: + +> `AgentUpdate:Configuration:Disable` — accepts re-enable signals from the extension at all times. + +This guarantees the extension can always reach the agent to restore it, even after a managed disable pushed via MDM or GPO. + +## Startup Enforcement + +When the Sentinel agent starts with the disabled flag set: + +| Flag | Startup Behaviour | +|------|------------------| +| **Enabled** | All services and DLP chains registered normally | +| **Disabled** | All service and chain registration skipped; only the re-enable channel is active | + +Nothing is created and torn down — services and chains simply never come into existence in the disabled startup path. + +## Observability + +Every kill and revive transition is logged with timestamp and trigger source. Check **Agent Status** in the dashboard to verify the current state. diff --git a/docs/browser-agent/kill-switch/quick-start.md b/docs/browser-agent/kill-switch/quick-start.md new file mode 100644 index 0000000..c9fd922 --- /dev/null +++ b/docs/browser-agent/kill-switch/quick-start.md @@ -0,0 +1,80 @@ +--- +sidebar_position: 1 +sidebar_custom_props: + icon: Rocket +--- + +# Quick Start + +Disable and re-enable the Sentinel endpoint agent from the browser extension in 4 steps. + + + +## 1. Disable the Agent + +Open the browser extension, navigate to **Agent Settings**, and toggle **Disable Agent**. The extension sends the disable signal to the Sentinel agent over the Native Messaging pipe. + +The agent responds immediately — no process restart is required. + +## 2. What Happens on the Endpoint + +| Step | Result | +|------|--------| +| **Flag persisted** | Disabled state written to local database — survives reboots | +| **Services stopped** | Clipboard monitoring and file indexing pause immediately | +| **DLP chains removed** | No clipboard, file, or network DLP events are processed | +| **Confirmed** | Extension receives confirmation; **Agent Status** updates to Disabled | + +## 3. Re-enable Channel + +While disabled, the agent ignores all events except re-enable signals. The re-enable channel is permanently preserved and cannot be removed — the extension can always reach the agent to restore it. + +If the endpoint reboots while disabled, the agent starts in the disabled state automatically. No action is required to maintain the disabled state across restarts. + +## 4. Re-enable the Agent + +Toggle **Enable Agent** in the extension. All services and DLP chains are restored without a process restart. + +| Step | Result | +|------|--------| +| **Flag cleared** | Enabled state written to local database | +| **Services restarted** | Clipboard monitoring and file indexing resume | +| **DLP chains restored** | Full event processing resumes immediately | +| **Confirmed** | Extension receives confirmation; **Agent Status** updates to Active | + +--- + +**Next step:** See the [Architecture](./architecture) for the full disable and startup enforcement details. diff --git a/docs/endpoint-agent/kill-switch/_category_.json b/docs/endpoint-agent/kill-switch/_category_.json new file mode 100644 index 0000000..1484237 --- /dev/null +++ b/docs/endpoint-agent/kill-switch/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "Kill Switch", + "position": 5, + "link": { + "type": "generated-index", + "description": "Runtime disable and re-enable of the Sentinel endpoint agent. Persisted in SQLite, enforced at startup and applied immediately at runtime without a process restart." + }, + "customProps": { + "icon": "Shield" + } +} diff --git a/docs/endpoint-agent/kill-switch/architecture.md b/docs/endpoint-agent/kill-switch/architecture.md new file mode 100644 index 0000000..d13b7b4 --- /dev/null +++ b/docs/endpoint-agent/kill-switch/architecture.md @@ -0,0 +1,85 @@ +--- +sidebar_position: 2 +sidebar_custom_props: + icon: Layers +--- + +# Architecture + +How the Sentinel endpoint agent enforces the kill switch — persisting state, stopping all DLP services, and restoring them on demand, without a process restart. + + + +## Pipeline Stages + +| Stage | Description | +|-------|-------------| +| **Kill Switch Handler** | The sole handler for the disable signal. Persists the flag to the local database, then applies the kill or revive operation synchronously. Returns confirmation to the extension on completion. | +| **Local Database** | Stores `disable_agent` as a boolean in a single-row configuration table. WAL mode ensures concurrent reads are never blocked. The flag persists across process restarts and reboots. | +| **Startup Enforcement** | On every agent start, the flag is read before any service or chain is registered. If disabled, all registration is skipped — nothing is created and torn down, services and chains simply never come into existence. | +| **Event Broker — Kill** | Removes all DLP process chains at runtime. Only the re-enable chain (`AgentUpdate:Configuration:Disable`) remains registered. | +| **Service Manager — Kill** | Calls stop on every running service. Clipboard monitor and file indexer reach `Stopped` state immediately. | +| **Event Broker — Revive** | Re-registers all DLP chains from the compiled chain configuration. Full event routing is restored. | +| **Service Manager — Revive** | Restarts all configured services from `Stopped` state. Full DLP coverage resumes. | + +## Preserved Chain + +One chain is never removed during a kill: + +| Chain | Purpose | +|-------|---------| +| `AgentUpdate:Configuration:Disable` | Accepts re-enable signals from the extension at all times | + +This guarantees the extension can always reach the agent to restore it — even after a managed disable deployed via MDM or GPO. + +## State Machine + +| Event | From | To | What Happens | +|-------|------|----|-------------| +| `disable_agent: true` received | Enabled | Disabled | Flag persisted; chains removed; services stopped | +| `disable_agent: false` received | Disabled | Enabled | Flag cleared; chains restored; services started | +| Agent starts, flag = disabled | — | Disabled | Registration skipped; only re-enable chain active | +| Agent starts, flag = enabled | — | Enabled | All chains and services registered normally | + +## Observability + +Kill and revive transitions are logged at warning level with the full list of affected chains and services. Check **Agent Status** in the dashboard to verify the current state of each endpoint. diff --git a/docs/endpoint-agent/kill-switch/quick-start.md b/docs/endpoint-agent/kill-switch/quick-start.md new file mode 100644 index 0000000..e116caf --- /dev/null +++ b/docs/endpoint-agent/kill-switch/quick-start.md @@ -0,0 +1,99 @@ +--- +sidebar_position: 1 +sidebar_custom_props: + icon: Rocket +--- + +# Quick Start + +Understand and verify kill switch behaviour on the Sentinel endpoint agent in 4 steps. + + + +## 1. Startup Enforcement + +Every time the Sentinel agent starts, it reads the kill switch flag from its local database before registering any services or chains. + +| Flag | What the Agent Does | +|------|---------------------| +| **Enabled** | All DLP chains and services registered normally — agent is fully operational | +| **Disabled** | All registration skipped; only the re-enable chain is created; agent waits silently | + +A managed disable (pushed via MDM or GPO) persists automatically across reboots — no re-disable needed. + +## 2. Kill Path + +When the agent receives `{ "disable_agent": true }` from the extension: + +| Step | Action | +|------|--------| +| **Persist** | Flag written to local database | +| **Remove chains** | All DLP event chains removed from the event broker | +| **Stop services** | Clipboard monitor and file indexer stopped | +| **Confirm** | Extension receives confirmation | + +The agent process continues running. Only chains and services are torn down. + +## 3. Disabled State + +While disabled, the agent ignores all events except re-enable signals. + +| Active | Inactive | +|--------|---------| +| Re-enable channel | Clipboard monitoring | +| Database connection | File indexing | +| Native Messaging listener | All DLP scanning | + +## 4. Revive Path + +When the agent receives `{ "disable_agent": false }` from the extension: + +| Step | Action | +|------|--------| +| **Persist** | Flag cleared in local database | +| **Restore chains** | All DLP event chains re-registered from configuration | +| **Restart services** | Clipboard monitor and file indexer restarted | +| **Confirm** | Extension receives confirmation | + +Full DLP coverage is restored without a process restart. No configuration is lost. + +## Default State + +The agent is **enabled by default**. The disabled flag is only set when explicitly pushed from the browser extension or an MDM policy. + +--- + +**Next step:** See the [Architecture](./architecture) for the full enforcement pipeline and state machine. From 90de21beb7334e2b5b6f6dd8dc62fd380ae93b6d Mon Sep 17 00:00:00 2001 From: adarshquilr Date: Sun, 19 Apr 2026 11:56:26 +0530 Subject: [PATCH 07/12] create sop as separate section --- .../browser-agent/kill-switch/_category_.json | 11 - .../kill-switch/_category_.json | 11 - .../endpoint-agent/kill-switch/quick-start.md | 99 -------- docs/sop/_category_.json | 11 + docs/sop/browser-extension/_category_.json | 11 + .../agent-kill-switch/_category_.json | 11 + .../agent-kill-switch}/architecture.md | 0 .../agent-kill-switch}/quick-start.md | 0 docs/sop/endpoint-agent/_category_.json | 11 + .../agent-kill-switch/_category_.json | 11 + .../agent-kill-switch}/architecture.md | 41 +++- .../agent-kill-switch/quick-start.md | 229 ++++++++++++++++++ 12 files changed, 317 insertions(+), 129 deletions(-) delete mode 100644 docs/browser-agent/kill-switch/_category_.json delete mode 100644 docs/endpoint-agent/kill-switch/_category_.json delete mode 100644 docs/endpoint-agent/kill-switch/quick-start.md create mode 100644 docs/sop/_category_.json create mode 100644 docs/sop/browser-extension/_category_.json create mode 100644 docs/sop/browser-extension/agent-kill-switch/_category_.json rename docs/{browser-agent/kill-switch => sop/browser-extension/agent-kill-switch}/architecture.md (100%) rename docs/{browser-agent/kill-switch => sop/browser-extension/agent-kill-switch}/quick-start.md (100%) create mode 100644 docs/sop/endpoint-agent/_category_.json create mode 100644 docs/sop/endpoint-agent/agent-kill-switch/_category_.json rename docs/{endpoint-agent/kill-switch => sop/endpoint-agent/agent-kill-switch}/architecture.md (58%) create mode 100644 docs/sop/endpoint-agent/agent-kill-switch/quick-start.md diff --git a/docs/browser-agent/kill-switch/_category_.json b/docs/browser-agent/kill-switch/_category_.json deleted file mode 100644 index 2aed72b..0000000 --- a/docs/browser-agent/kill-switch/_category_.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "label": "Kill Switch", - "position": 3, - "link": { - "type": "generated-index", - "description": "Remotely disable or re-enable the Sentinel endpoint agent from the browser extension. State is persisted across restarts; the re-enable channel is preserved at all times." - }, - "customProps": { - "icon": "Shield" - } -} diff --git a/docs/endpoint-agent/kill-switch/_category_.json b/docs/endpoint-agent/kill-switch/_category_.json deleted file mode 100644 index 1484237..0000000 --- a/docs/endpoint-agent/kill-switch/_category_.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "label": "Kill Switch", - "position": 5, - "link": { - "type": "generated-index", - "description": "Runtime disable and re-enable of the Sentinel endpoint agent. Persisted in SQLite, enforced at startup and applied immediately at runtime without a process restart." - }, - "customProps": { - "icon": "Shield" - } -} diff --git a/docs/endpoint-agent/kill-switch/quick-start.md b/docs/endpoint-agent/kill-switch/quick-start.md deleted file mode 100644 index e116caf..0000000 --- a/docs/endpoint-agent/kill-switch/quick-start.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -sidebar_position: 1 -sidebar_custom_props: - icon: Rocket ---- - -# Quick Start - -Understand and verify kill switch behaviour on the Sentinel endpoint agent in 4 steps. - - - -## 1. Startup Enforcement - -Every time the Sentinel agent starts, it reads the kill switch flag from its local database before registering any services or chains. - -| Flag | What the Agent Does | -|------|---------------------| -| **Enabled** | All DLP chains and services registered normally — agent is fully operational | -| **Disabled** | All registration skipped; only the re-enable chain is created; agent waits silently | - -A managed disable (pushed via MDM or GPO) persists automatically across reboots — no re-disable needed. - -## 2. Kill Path - -When the agent receives `{ "disable_agent": true }` from the extension: - -| Step | Action | -|------|--------| -| **Persist** | Flag written to local database | -| **Remove chains** | All DLP event chains removed from the event broker | -| **Stop services** | Clipboard monitor and file indexer stopped | -| **Confirm** | Extension receives confirmation | - -The agent process continues running. Only chains and services are torn down. - -## 3. Disabled State - -While disabled, the agent ignores all events except re-enable signals. - -| Active | Inactive | -|--------|---------| -| Re-enable channel | Clipboard monitoring | -| Database connection | File indexing | -| Native Messaging listener | All DLP scanning | - -## 4. Revive Path - -When the agent receives `{ "disable_agent": false }` from the extension: - -| Step | Action | -|------|--------| -| **Persist** | Flag cleared in local database | -| **Restore chains** | All DLP event chains re-registered from configuration | -| **Restart services** | Clipboard monitor and file indexer restarted | -| **Confirm** | Extension receives confirmation | - -Full DLP coverage is restored without a process restart. No configuration is lost. - -## Default State - -The agent is **enabled by default**. The disabled flag is only set when explicitly pushed from the browser extension or an MDM policy. - ---- - -**Next step:** See the [Architecture](./architecture) for the full enforcement pipeline and state machine. diff --git a/docs/sop/_category_.json b/docs/sop/_category_.json new file mode 100644 index 0000000..a6e8218 --- /dev/null +++ b/docs/sop/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "SOP", + "position": 6, + "link": { + "type": "generated-index", + "description": "Standard operating procedures for incident handling — disable, rollback, and restore Quilr agents without a code deploy or engineering intervention." + }, + "customProps": { + "icon": "BookOpen" + } +} diff --git a/docs/sop/browser-extension/_category_.json b/docs/sop/browser-extension/_category_.json new file mode 100644 index 0000000..4d4302f --- /dev/null +++ b/docs/sop/browser-extension/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "Browser Extension", + "position": 2, + "link": { + "type": "generated-index", + "description": "Incident procedures for the Quilr Browser Extension — kill switch, rollback, and escalation playbooks." + }, + "customProps": { + "icon": "Plug" + } +} diff --git a/docs/sop/browser-extension/agent-kill-switch/_category_.json b/docs/sop/browser-extension/agent-kill-switch/_category_.json new file mode 100644 index 0000000..6c25fdd --- /dev/null +++ b/docs/sop/browser-extension/agent-kill-switch/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "Agent Kill Switch", + "position": 1, + "link": { + "type": "generated-index", + "description": "Disable or re-enable the Sentinel endpoint agent from the browser extension — without a process restart, with state persisted across reboots." + }, + "customProps": { + "icon": "ShieldCheck" + } +} diff --git a/docs/browser-agent/kill-switch/architecture.md b/docs/sop/browser-extension/agent-kill-switch/architecture.md similarity index 100% rename from docs/browser-agent/kill-switch/architecture.md rename to docs/sop/browser-extension/agent-kill-switch/architecture.md diff --git a/docs/browser-agent/kill-switch/quick-start.md b/docs/sop/browser-extension/agent-kill-switch/quick-start.md similarity index 100% rename from docs/browser-agent/kill-switch/quick-start.md rename to docs/sop/browser-extension/agent-kill-switch/quick-start.md diff --git a/docs/sop/endpoint-agent/_category_.json b/docs/sop/endpoint-agent/_category_.json new file mode 100644 index 0000000..9cdd7c7 --- /dev/null +++ b/docs/sop/endpoint-agent/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "Endpoint Agent", + "position": 1, + "link": { + "type": "generated-index", + "description": "Incident procedures for the Quilr Endpoint Agent — kill switch, rollback, and escalation playbooks." + }, + "customProps": { + "icon": "Bot" + } +} diff --git a/docs/sop/endpoint-agent/agent-kill-switch/_category_.json b/docs/sop/endpoint-agent/agent-kill-switch/_category_.json new file mode 100644 index 0000000..12339af --- /dev/null +++ b/docs/sop/endpoint-agent/agent-kill-switch/_category_.json @@ -0,0 +1,11 @@ +{ + "label": "Agent Kill Switch", + "position": 1, + "link": { + "type": "generated-index", + "description": "Disable or restore the Sentinel endpoint agent on a single device or entire tenant — without a code deploy or engineering intervention." + }, + "customProps": { + "icon": "ShieldCheck" + } +} diff --git a/docs/endpoint-agent/kill-switch/architecture.md b/docs/sop/endpoint-agent/agent-kill-switch/architecture.md similarity index 58% rename from docs/endpoint-agent/kill-switch/architecture.md rename to docs/sop/endpoint-agent/agent-kill-switch/architecture.md index d13b7b4..b0781de 100644 --- a/docs/endpoint-agent/kill-switch/architecture.md +++ b/docs/sop/endpoint-agent/agent-kill-switch/architecture.md @@ -10,11 +10,17 @@ How the Sentinel endpoint agent enforces the kill switch — persisting state, s + +## Quick Reference + +| Situation | Action | Time to Effect | +|-----------|--------|----------------| +| Disable agent for **one device** | Backend: set `endpointAgentEnabled = false` | Next poll cycle (~30 min) | +| Disable agent for **entire tenant** | Backend: set `tenantEndpointAgentEnabled = false` | Next poll cycle (~30 min) | +| Disable agent **right now** on one machine | IT: `launchctl bootout` (see below) | Immediate | +| Roll back to a previous version | IT: re-run installer script (see below) | ~5 minutes | +| Disable a specific sub-feature | Engineering required — see [Sub-feature Flags](#sub-feature-flags) | Requires deploy | + +--- + +## 1. Disable for a Single Device + +> **Who**: Anyone with access to the Quilr admin dashboard or backend API. + +The agent goes dormant but stays installed. It re-checks every ~30 minutes and resumes if the flag is turned back on. + +| Step | Action | +|------|--------| +| **1** | Log in to the Quilr admin backend (BFF) | +| **2** | Find the device record by device ID or user email | +| **3** | Set `endpointAgentEnabled = false` and save | +| **4** | Confirm: agent status endpoint returns `enabled: false` within one poll cycle | + +To re-enable, set `endpointAgentEnabled = true` and save. + +--- + +## 2. Disable for an Entire Tenant + +> **Who**: Anyone with tenant-level admin access. + +Disables the agent across all devices for that tenant. The tenant-level flag takes priority over device-level flags. + +| Step | Action | +|------|--------| +| **1** | Log in to the Quilr admin backend | +| **2** | Find the tenant record | +| **3** | Set `tenantEndpointAgentEnabled = false` and save | +| **4** | Confirm: spot-check one or two devices — agents should stop within the next poll cycle | + +To re-enable, set `tenantEndpointAgentEnabled = true` and save. + +:::note +If the tenant flag is `false`, individual device flags are ignored — the tenant flag always wins. +::: + +--- + +## 3. Immediate Stop on a Specific Machine + +> **Who**: IT / helpdesk with sudo access to the macOS machine. + +Use this when you cannot wait for the next backend poll cycle. + +### Stop the agent + +```bash +sudo launchctl bootout "system/com.sentinel.agent" +``` + +All monitoring and proxy interception ceases immediately. + +### Verify the agent is stopped + +```bash +sudo launchctl list | grep sentinel +``` + +Returns nothing if the agent is stopped. + +### Restart the agent + +```bash +sudo launchctl bootstrap system "/Library/LaunchDaemons/com.sentinel.agent.plist" +``` + +### Prevent restart on reboot (persistent stop) + +```bash +sudo launchctl disable "system/com.sentinel.agent" +sudo launchctl bootout "system/com.sentinel.agent" +``` + +To re-enable after a persistent stop: + +```bash +sudo launchctl enable "system/com.sentinel.agent" +sudo launchctl bootstrap system "/Library/LaunchDaemons/com.sentinel.agent.plist" +``` + +:::warning +Stopping via `launchctl` is temporary by default. The agent restarts on reboot unless you also run the `disable` command above. +::: + +--- + +## 4. Roll Back to a Previous Version + +> **Who**: IT with sudo access, or engineering via MDM. + +### Option A — Re-run the installer + +```bash +sudo /usr/local/sentinel/scripts/sentinel-endpoint.sh --env --force +``` + +Replace `` with `quartz`, `preprod`, or `secure`. The installer pulls the latest stable release and overwrites the broken version. + +### Option B — Clear a stuck auto-rollback + +If the agent auto-rolled back after a failed upgrade but the device is still having issues: + +```bash +# Check what version was rejected +cat ~/.sentinel/.quarantined_version + +# Remove the quarantine file to let the agent retry +rm ~/.sentinel/.quarantined_version +``` + +Then restart the agent (see Section 3). + +### Confirm the active version + +```bash +cat /usr/local/sentinel/VERSION +``` + +--- + +## Sub-feature Flags + +The following sub-features have their own `enabled` flags but are **not yet remotely toggleable** without a code change. Open an incident ticket and tag the on-call engineer. + +| Sub-feature | What it does | Config flag | +|-------------|--------------|-------------| +| Enforcement | Kills non-compliant processes | `enforcement.enabled` | +| Enforcement dry-run | Logs violations but does NOT kill processes | `enforcement.dry_run` | +| File scanning | Scans for sensitive files (`.claude`, `.cursor`, etc.) | `scan.enabled` | +| Hook integrity | Verifies Claude/Cursor hook files aren't tampered | `hook_manager.enabled` | +| Package scanning (npm/cargo/go) | Scans installed packages | `pkg_scanner.enabled` | + +**Workaround while waiting for engineering**: Use the tenant or device-level kill switch (Sections 1–2) to stop the entire agent. + +--- + +## Severity & Escalation + +| Severity | Symptoms | First action | Escalate if | +|----------|----------|--------------|-------------| +| **P0 – Critical** | Agent breaking user workflows, blocking logins, data loss risk | Immediate stop via launchctl + tenant flag off | Not resolved in 15 min | +| **P1 – High** | Feature misbehaving for a group of users | Device-level flag off | Affecting >5 devices | +| **P2 – Medium** | Unexpected behavior, no immediate harm | Backend toggle + monitor | Persists after toggle | +| **P3 – Low** | Cosmetic, minor annoyance | Log ticket | — | + +Tag `#sentinel-oncall` in Slack with the device ID, tenant ID, and what you observed. + +--- + +## Verification Checklist + +After any kill switch action: + +- [ ] Agent status endpoint returns `enabled: false` for the affected device(s) +- [ ] `launchctl list | grep sentinel` shows not running (if stopped via IT) +- [ ] User confirms monitoring and proxy interception has stopped +- [ ] No new alerts or logs from the device for 5 minutes post-action +- [ ] If tenant-wide: spot-check at least 3 devices from the tenant + +--- + +## Re-enabling After an Incident + +1. Confirm the root cause has been identified. +2. Confirm a fix is in place (code deploy, config change, or false alarm). +3. Re-enable at the device level first (one test device) and monitor for 10 minutes. +4. If clean, re-enable for the full tenant. +5. Post a brief incident summary in `#sentinel-oncall` with what was toggled and when. + +--- + +**Next step:** See the [Architecture](./architecture) for the full enforcement pipeline and state machine. From a4b55958fda2832fcf3528bf7b305ce2199de2d0 Mon Sep 17 00:00:00 2001 From: adarshquilr Date: Thu, 23 Apr 2026 15:07:08 +0530 Subject: [PATCH 08/12] keep only instructions in sop --- .claude/settings.local.json | 9 +++ .../agent-kill-switch/architecture.md | 0 .../agent-kill-switch/quick-start.md | 0 .../agent-kill-switch/architecture.md | 0 docs/sop/_category_.json | 2 +- .../agent-kill-switch/instructions.md | 74 +++++++++++++++++++ 6 files changed, 84 insertions(+), 1 deletion(-) create mode 100644 .claude/settings.local.json rename docs/{sop/browser-extension => browser-agent}/agent-kill-switch/architecture.md (100%) rename docs/{sop/browser-extension => browser-agent}/agent-kill-switch/quick-start.md (100%) rename docs/{sop => }/endpoint-agent/agent-kill-switch/architecture.md (100%) create mode 100644 docs/sop/browser-extension/agent-kill-switch/instructions.md diff --git a/.claude/settings.local.json b/.claude/settings.local.json new file mode 100644 index 0000000..fe3512b --- /dev/null +++ b/.claude/settings.local.json @@ -0,0 +1,9 @@ +{ + "permissions": { + "allow": [ + "Bash(cp \"/Users/adarsh/Desktop/Screenshot 2026-04-19 at 12.35.53 PM.heic\" /tmp/ss1.heic)", + "Bash(cp \"/Users/adarsh/Desktop/Screenshot 2026-04-19 at 12.36.53 PM.heic\" /tmp/ss2.heic)", + "Bash(cp \"/Users/adarsh/Desktop/Screenshot 2026-04-19 at 12.47.26 PM.heic\" /tmp/ss3.heic)" + ] + } +} diff --git a/docs/sop/browser-extension/agent-kill-switch/architecture.md b/docs/browser-agent/agent-kill-switch/architecture.md similarity index 100% rename from docs/sop/browser-extension/agent-kill-switch/architecture.md rename to docs/browser-agent/agent-kill-switch/architecture.md diff --git a/docs/sop/browser-extension/agent-kill-switch/quick-start.md b/docs/browser-agent/agent-kill-switch/quick-start.md similarity index 100% rename from docs/sop/browser-extension/agent-kill-switch/quick-start.md rename to docs/browser-agent/agent-kill-switch/quick-start.md diff --git a/docs/sop/endpoint-agent/agent-kill-switch/architecture.md b/docs/endpoint-agent/agent-kill-switch/architecture.md similarity index 100% rename from docs/sop/endpoint-agent/agent-kill-switch/architecture.md rename to docs/endpoint-agent/agent-kill-switch/architecture.md diff --git a/docs/sop/_category_.json b/docs/sop/_category_.json index a6e8218..8295b74 100644 --- a/docs/sop/_category_.json +++ b/docs/sop/_category_.json @@ -1,5 +1,5 @@ { - "label": "SOP", + "label": "Std Operating Procedure", "position": 6, "link": { "type": "generated-index", diff --git a/docs/sop/browser-extension/agent-kill-switch/instructions.md b/docs/sop/browser-extension/agent-kill-switch/instructions.md new file mode 100644 index 0000000..e873ba2 --- /dev/null +++ b/docs/sop/browser-extension/agent-kill-switch/instructions.md @@ -0,0 +1,74 @@ +--- +sidebar_position: 1 +sidebar_custom_props: + icon: ClipboardList +--- + +Go to https://github.com/quilrbusiness/ConstantsConfigsSync + +Make changes in the tenant specific json file in `constants/defaults/abc-...json` + +Raise a PR to main + +Contact Kashi or Thiru for PR approval and merge. + + +## Step 1 – Create a branch from main + +Pull the latest main, then create a new branch named like: + +``` +feat/add-enable-extension-management +``` + +## Step 2 – Add your constant + +If the constant is for all tenants, add it to `default.json`. + +`default.json` + +```json +{ + "ENABLE_EXTENSION_MANAGEMENT": true +} +``` + +If the constant is tenant-specific, add or override it inside: + +`constants/tenants/.json` + +Example: `442e052d-4c60-4cdc-961e-bc9db74a40ca.json` + +```json +{ + "ENABLE_EXTENSION_MANAGEMENT": true +} +``` + +- Tenant value overrides the global value for that tenant only +- Other tenants continue using `default.json` +- If the tenant file doesn't exist, create it using the tenant UUID + + +## Step 3 – Commit & push + +Stage only the files under `constants` that you changed. + +Example commit messages: + +``` +feat: add ENABLE_EXTENSION_MANAGEMENT constant globally +feat: override ENABLE_EXTENSION_MANAGEMENT for tenant 442e052d +``` + +Push your branch. + +## Step 4 – Raise a PR + +Create a Pull Request to main. In the PR description include: + +- What `ENABLE_EXTENSION_MANAGEMENT` does +- Whether it's global or tenant-specific +- Tenant UUID (if applicable) + +We can find tenant ID in browser extension API calls. From db9e3ff09dd6bdc69d2e0b2d40d65c86f20ab7b0 Mon Sep 17 00:00:00 2001 From: adarshquilr Date: Thu, 23 Apr 2026 15:29:49 +0530 Subject: [PATCH 09/12] remove em dashes --- docs/sop/_category_.json | 2 +- docs/sop/browser-extension/_category_.json | 2 +- docs/sop/browser-extension/agent-kill-switch/_category_.json | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/sop/_category_.json b/docs/sop/_category_.json index 8295b74..040afdc 100644 --- a/docs/sop/_category_.json +++ b/docs/sop/_category_.json @@ -3,7 +3,7 @@ "position": 6, "link": { "type": "generated-index", - "description": "Standard operating procedures for incident handling — disable, rollback, and restore Quilr agents without a code deploy or engineering intervention." + "description": "Standard operating procedures for incident handling: disable, rollback, and restore Quilr agents without a code deploy or engineering intervention." }, "customProps": { "icon": "BookOpen" diff --git a/docs/sop/browser-extension/_category_.json b/docs/sop/browser-extension/_category_.json index 4d4302f..6630cc9 100644 --- a/docs/sop/browser-extension/_category_.json +++ b/docs/sop/browser-extension/_category_.json @@ -3,7 +3,7 @@ "position": 2, "link": { "type": "generated-index", - "description": "Incident procedures for the Quilr Browser Extension — kill switch, rollback, and escalation playbooks." + "description": "Incident procedures for the Quilr Browser Extension: kill switch, rollback, and escalation playbooks." }, "customProps": { "icon": "Plug" diff --git a/docs/sop/browser-extension/agent-kill-switch/_category_.json b/docs/sop/browser-extension/agent-kill-switch/_category_.json index 6c25fdd..9de7cd0 100644 --- a/docs/sop/browser-extension/agent-kill-switch/_category_.json +++ b/docs/sop/browser-extension/agent-kill-switch/_category_.json @@ -3,7 +3,7 @@ "position": 1, "link": { "type": "generated-index", - "description": "Disable or re-enable the Sentinel endpoint agent from the browser extension — without a process restart, with state persisted across reboots." + "description": "Disable or re-enable the Sentinel endpoint agent from the browser extension without a process restart, with state persisted across reboots." }, "customProps": { "icon": "ShieldCheck" From 1bc4420db50281265806e585a94f9a4df0dda744 Mon Sep 17 00:00:00 2001 From: adarshquilr Date: Thu, 23 Apr 2026 16:11:23 +0530 Subject: [PATCH 10/12] bugfix: update key --- .../agent-kill-switch/instructions.md | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/docs/sop/browser-extension/agent-kill-switch/instructions.md b/docs/sop/browser-extension/agent-kill-switch/instructions.md index e873ba2..5f3d8e3 100644 --- a/docs/sop/browser-extension/agent-kill-switch/instructions.md +++ b/docs/sop/browser-extension/agent-kill-switch/instructions.md @@ -12,13 +12,14 @@ Raise a PR to main Contact Kashi or Thiru for PR approval and merge. +Note: We can find tenant ID in browser extension API calls. ## Step 1 – Create a branch from main Pull the latest main, then create a new branch named like: ``` -feat/add-enable-extension-management +feat/disable-agent-kill-switch ``` ## Step 2 – Add your constant @@ -29,7 +30,7 @@ If the constant is for all tenants, add it to `default.json`. ```json { - "ENABLE_EXTENSION_MANAGEMENT": true + "disable_agent": true } ``` @@ -41,7 +42,7 @@ Example: `442e052d-4c60-4cdc-961e-bc9db74a40ca.json` ```json { - "ENABLE_EXTENSION_MANAGEMENT": true + "disable_agent": true } ``` @@ -57,8 +58,8 @@ Stage only the files under `constants` that you changed. Example commit messages: ``` -feat: add ENABLE_EXTENSION_MANAGEMENT constant globally -feat: override ENABLE_EXTENSION_MANAGEMENT for tenant 442e052d +feat: add disable_agent constant globally +feat: override disable_agent for tenant 442e052d ``` Push your branch. @@ -67,8 +68,6 @@ Push your branch. Create a Pull Request to main. In the PR description include: -- What `ENABLE_EXTENSION_MANAGEMENT` does +- What `disable_agent` does - Whether it's global or tenant-specific - Tenant UUID (if applicable) - -We can find tenant ID in browser extension API calls. From f5c40f1975c7f19fb64ac40706e209344054784d Mon Sep 17 00:00:00 2001 From: adarshquilr Date: Thu, 23 Apr 2026 17:30:10 +0530 Subject: [PATCH 11/12] use preprod --- .../agent-kill-switch/instructions.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/sop/browser-extension/agent-kill-switch/instructions.md b/docs/sop/browser-extension/agent-kill-switch/instructions.md index 5f3d8e3..7dd5b12 100644 --- a/docs/sop/browser-extension/agent-kill-switch/instructions.md +++ b/docs/sop/browser-extension/agent-kill-switch/instructions.md @@ -8,15 +8,18 @@ Go to https://github.com/quilrbusiness/ConstantsConfigsSync Make changes in the tenant specific json file in `constants/defaults/abc-...json` -Raise a PR to main +Raise a PR to quilr-preprod, get approval and merged then quilr-preprod to main Contact Kashi or Thiru for PR approval and merge. Note: We can find tenant ID in browser extension API calls. -## Step 1 – Create a branch from main -Pull the latest main, then create a new branch named like: +Details: + +## Step 1 – Create a branch from quilr-preprod + +Pull the latest quilr-preprod, then create a new branch named like: ``` feat/disable-agent-kill-switch @@ -66,7 +69,7 @@ Push your branch. ## Step 4 – Raise a PR -Create a Pull Request to main. In the PR description include: +Create a Pull Request to quilr-preprod and then to main. In the PR description include: - What `disable_agent` does - Whether it's global or tenant-specific From 219f89a98ab27afd025a112ed489f87418d7ecbe Mon Sep 17 00:00:00 2001 From: vaishnavs0 Date: Thu, 23 Apr 2026 17:58:37 +0530 Subject: [PATCH 12/12] fix: broken page path issue --- docs/sop/endpoint-agent/agent-kill-switch/quick-start.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/sop/endpoint-agent/agent-kill-switch/quick-start.md b/docs/sop/endpoint-agent/agent-kill-switch/quick-start.md index eefbc6f..33e8b19 100644 --- a/docs/sop/endpoint-agent/agent-kill-switch/quick-start.md +++ b/docs/sop/endpoint-agent/agent-kill-switch/quick-start.md @@ -226,4 +226,4 @@ After any kill switch action: --- -**Next step:** See the [Architecture](./architecture) for the full enforcement pipeline and state machine. +**Next step:** See the [Architecture](../../../endpoint-agent/agent-kill-switch/architecture) for the full enforcement pipeline and state machine.