Operator console
Authenticate with the tenant and operator token issued when the tenant was created. The token is kept in this browser only and sent as a bearer header to this control plane.
NEEDS ATTENTION
PLAN & ENTITLEMENTS
SEATS
| HOST | OS / ARCH | VERSION | STATUS | POLICY | DENIES 24H | WORKLOADS | LAST SEEN | |
|---|---|---|---|---|---|---|---|---|
| Loading fleet… | ||||||||
ENROLL A WORKSTATION
Generate an enrollment token
Tenant-scoped and single-use. The host credential minted from it only ever reaches this tenant, so a token handed to the wrong host still cannot cross tenants.
Download the agent and install it as a service
One static binary, no dependencies. Download it for the target machine, drop in the config block above, and start it. Pick the OS:
Place the binary:
chmod +x vorn-linux-amd64 sudo mv vorn-linux-amd64 /usr/local/bin/vorn
Create /etc/vorn/config.yaml with:
Register and start the systemd service:
sudo vorn install
One file, one step. The installer detects Apple Silicon or Intel, installs the agent as a service, checks in with your tenant, and turns on capture so this Mac's AI egress flows through the agent automatically. No config, no manual proxy. Capture reverts when the agent stops; to undo it by hand, run sudo networksetup -setsocksfirewallproxystate Wi-Fi off.
Double-click vorn-install.command. The first time, right-click it and choose Open to clear Gatekeeper, then enter your Mac password when asked. Done.
Paste it in Terminal and enter your password. Done.
Both paths enroll this Mac with your tenant. The single hidden /etc/vorn/config.yaml they write is shown under Advanced if you want to review it.
Advanced · the config it writes
Place the binary (elevated PowerShell):
mkdir "$env:ProgramFiles\Vorn" -Force Move-Item vorn-windows-amd64.exe "$env:ProgramFiles\Vorn\vorn.exe"
Create C:\ProgramData\Vorn\config.yaml with:
Register and start the Windows service:
& "$env:ProgramFiles\Vorn\vorn.exe" install
Verify your download against SHA256SUMS.
Confirm a good connection
- The agent log shows enrolled as <id> with . Linux: journalctl -u vorn -f · macOS: the vorn log file, or log stream --predicate 'process=="vorn"' · Windows: the log file or Event Viewer.
- The agent's local health endpoint returns ok: curl http://127.0.0.1:7433/healthz gives {"status":"ok"}. Loopback only; the agent is headless with no web UI.
- Within about 60 seconds the host appears under FLEET with status active and a recent last-seen that keeps advancing as heartbeats arrive.
Connected, but no traffic observed yet. The agent only records AI egress that passes through it. On macOS, enable capture or route traffic through the agent (ALL_PROXY=socks5h://127.0.0.1:1080); on Linux the transparent redirect captures it automatically. Generate any AI call and it appears in EVENTS within seconds.
| TIME | AGENT | MODULE | KIND | DECISION | SEVERITY | RULE | TARGET |
|---|---|---|---|---|---|---|---|
| Loading events… | |||||||
ACTIVE POLICY
DEFAULT POSTURE
RULES
- 1 · Action
- 2 · Destination
- 3 · Scope
- Review
ADVANCED · EDIT RAW POLICY
VERSION HISTORY
| VERSION | BY | COMMENT | AT |
|---|---|---|---|
| Loading… | |||
| TIME | ACTOR | ACTION | RESOURCE | FROM |
|---|---|---|---|---|
| Loading audit trail… | ||||