Policies & Managed Deployment
IT managers define what gets installed, how it's configured, and who gets what. A lightweight installer provisions the entire environment for every employee and collaborator — client, plugins, models, settings — in minutes, not hours.
The problem
Without central control, every user installs different versions, skips plugins, picks their own models, and changes settings. IT can't see what's running, can't enforce standards, and can't prove compliance.
The light installer
A 10 MB installer that authenticates via SSO, fetches an encrypted policy, and provisions the complete environment. IT distributes it through their existing MDM — Intune, Jamf, or any deployment tool.
The installer opens your organisation's SSO provider (Entra ID, Okta, Google) in the system browser. No credentials are stored locally. Auth happens before any software is downloaded.
After authentication, the installer requests the user's resolved policy from the Swarmix server. The policy is encrypted and signed — tailored to the user's group membership and role.
The installer downloads the client app, plugins, and models specified by the policy. Every artifact is SHA256-verified. Post-install steps configure embeddings, vector stores, and plugin settings.
The device exchanges cryptographic keys with the server and registers for ongoing policy management. From this point, the client's built-in policy agent handles updates automatically.
The client app starts with everything configured. The user is productive immediately — the right plugins, the right models, the right settings. No manual setup, no guesswork.
Inside a policy
A policy is a declarative specification: which client version, which plugins, which models, which settings — and who gets it.
Capabilities
Six capabilities that give IT managers full control over what users run — without slowing them down.
Policies are signed with Ed25519 and encrypted per-device with AES-256-GCM. The server resolves, merges, and delivers each user's policy after authentication. No plaintext policies on disk.
Each policy resolves to a concrete bundle: a specific client version, a set of plugins at pinned versions, configuration overrides, and post-install steps — all verified by SHA256 checksums.
Assign policies to groups, roles, or individual users. When a user belongs to multiple groups, policies merge deterministically — plugins are unioned, restrictions follow most-restrictive-wins.
Roll out changes in phases — canary to 5%, then engineering, then everyone. Success criteria gate each phase. If error rates spike, the system pauses and optionally rolls back automatically.
Every enrolled device reports its state on a configurable interval. The dashboard shows compliance percentage, drift events, stale devices, and deployment progress — all auditable.
When an organisation requires managed installation, the server blocks unenrolled clients. Three enforcement modes let you roll out gradually: audit first, then partial, then full.
Phased rollouts
Create a deployment, pick a strategy, and define success criteria. The scheduler rolls out your policy in phases. Each phase waits for enough devices to report success before proceeding.
If error rates exceed your threshold, the deployment pauses automatically. One click rolls back to the previous policy. Every device, every phase, every error is logged for audit.
Adaptive sync intervals speed up during active deployments and throttle back during steady state — no bandwidth storms, no thundering herds.
Works with your stack
Your device MDM handles the device. Swarmix policies handle the application. The installer is an MSI, PKG, or DEB — distribute it the way you already distribute everything else.
Push the installer MSI via Intune. Groups sync from Entra ID via SCIM. SSO for authentication.
Distribute the PKG via Jamf policies. Keychain integration for at-rest policy encryption.
Automate with DEB/RPM packages. Silent mode for headless deployment. Scripts for detection.
Groups and users sync from your Identity Provider. Policy targeting mirrors your AD structure.
The outcome
Drift detection
The policy agent on each device continuously compares actual state to desired state. If a user uninstalls a required plugin, changes a locked setting, or installs an unapproved extension — the dashboard shows it within minutes.
Remediation is configurable per restriction: auto-fix silently, warn and fix, report to admin, or block the app until resolved. You control the trade-off between user freedom and organisational compliance.
We're designing policies and MDM integration now. Register your interest to influence the roadmap and be the first to try it.
Swarmix is almost ready. Leave your email and we'll send you an access code.