Run your first monitored rollout

Start with a small pilot and keep policy in Monitor mode. Monitor evaluates the same rules as Active mode but does not alter or block a user action.

Before you enroll devices

1. Confirm the organization and administrator accounts are ready.
2. Open AI app catalog and review the risk records for the AI tools your organization already approves.
3. Open Policies and review the starter templates. If a rule targets role or AI account context, first assign the pilot member's organization role and deploy authoritative managed account values to that browser profile. Unknown context does not satisfy a narrower identity rule.
4. Open Sensors & keys and provision a sensor credential for the pilot. The raw credential is shown once, so store it in the deployment system rather than a ticket or chat.
5. Choose the coverage layer: browser extension, desktop protection, or AI gateway.

Pilot sequence

1. Enroll a few security and IT users.
2. Confirm each sensor checks in and appears healthy.
3. Use invented test data to exercise common detectors. Never paste real customer data, employee records, credentials, or source secrets into a test.
4. Review AI app discovery and Violations. Events should contain detector metadata and placeholders, not original sensitive values.
5. Tune noisy rules and custom patterns.
6. Leave the pilot in Monitor mode long enough to understand normal use.
7. On Protect or higher, move one low-risk policy to Active and verify coaching or redaction before enabling hard blocks. For Require approval, test denial, expiry, one-use consumption, a changed prompt, and a retry from a different pilot key before enabling it broadly.
8. Expand enrollment in stages and monitor stale sensors.

A successful pilot

The pilot is ready to expand when:

• supported AI apps appear in Discovery with the expected users and activity;
• policy decisions are explainable and false positives are manageable;
• no telemetry, export, or application log contains the synthetic raw value;
• sensor policy versions update after an administrator changes a rule;
• the coverage panel accurately shows the environments that are not enrolled.

See Protected environments for installation choices and Policies and detection before activating enforcement.