ProductsHow It WorksThe StudioThe Orchestrator
EnterpriseOverviewIntelligenceWho It's ForSecurityIT Governance
Pricing
ResourcesBlogFAQ
Get in touch

Policies & IT

AI tooling under IT governance

Everything IT needs to manage AI tooling across the organisation.

  • SSO and SCIM 2.0 provisioning from the existing identity provider
  • Policy control over vendors, models, tools, and plugins
  • On-device data protection with local ML detection
  • Usage analytics and OpenTelemetry instrumentation
  • Accelerates the path to ISO 42001 compliance
78%
of employees bring their own AI tools to work, outside IT control
Microsoft Work Trend Index 2024
$670K
additional cost per data breach involving shadow AI
IBM Cost of a Data Breach 2025
52.7%
of purchased SaaS licenses go unused across the organisation
Zylo SaaS Management Index 2025
51 days
lost per employee per year to technology friction
WalkMe State of Digital Adoption 2026

Single Sign-On

Google, Microsoft, SAML 2.0, OpenID Connect. Any standards-compliant identity provider.

SCIM 2.0 Provisioning

Automated user and group sync. Tested with Okta, Azure AD, and OneLogin. Users and groups create, update, and deprovision automatically.

Group-Based Policy Targeting

Policies assign to groups synced from the IdP. No manual user-to-policy mapping required.

Configurable Deprovisioning

Soft deactivate (preserves data, user can be re-provisioned) or full removal (revokes sessions, deletes memberships, removes from groups).

Linked Accounts

Users link multiple SSO providers to one identity. Switching identity providers does not create duplicate accounts.

Session Isolation

Sessions are scoped per device. Revoking one device does not affect others. Brute-force protection on all auth endpoints.

SSOGoogle, Microsoft, SAML, OIDC
SCIM 2.0Okta, Azure AD, OneLogin
Multi-orgUsers switch between organisations
The existing MDM distributes the installer
Microsoft IntuneJamf ProSCCM / Ansible
Pushes installer
LIGHT INSTALLER
Authenticate · Fetch Policy · Download · Verify · Configure · Enroll

Provisions
What lands on the user's machine
Swarmix Client
pinned version
Plugins
configured per policy
AI Models
embeddings, rankers
Settings
locked or defaults
01

Authenticate

The installer opens the organisation's SSO provider (Entra ID, Okta, Google) in the system browser. No credentials are stored locally. Auth happens before any software is downloaded.

02

Fetch Policy

After authentication, the installer requests the user's resolved policy from the Swarmix server. The policy is encrypted and signed — tailored to the user's group membership and role.

03

Provision

The installer downloads the client app, plugins, and models specified by the policy. Every artifact is SHA256-verified. Post-install steps configure embeddings, vector stores, and plugin settings.

04

Enroll

The device exchanges cryptographic keys with the server and registers for ongoing policy management. From this point, the client's built-in policy agent handles updates automatically.

05

Launch

The client app starts with everything configured. The user is productive immediately — the right plugins, the right models, the right settings. No manual setup, no guesswork.

Policy: Engineering Team — Standard
v7 · Active · Targets: Engineering, ML Team
Client
Channelstable
Version^2.5.0
Auto-updatewithin constraint
Plugins
Code Intelligence^1.2.0 (required)
Documents^1.0.0 (required)
Knowledge Intellatest (optional)
Post-Install
Embedding modelMiniLM-L6-v2 (91 MB)
Ranker modelms-marco-MiniLM (85 MB)
Vector storeinitialise on first run
Vendors & Models
Allowed vendorsAnthropic, OpenAI
Blocked vendorsall others
Allowed modelsclaude-sonnet-4-20250514, gpt-4o
Settings & Restrictions
Server URLlocked
Telemetrylocked (enabled)
Plugin installblocked (policy only)
Signed: Ed25519Encrypted: AES-256-GCM

Encrypted Policy Documents

Policies are signed with Ed25519 and encrypted per-device with AES-256-GCM. The server resolves, merges, and delivers each user's policy after authentication. No plaintext policies on disk.

  • Per-org signing keys with rotation
  • Per-device encryption via X25519 key exchange
  • Anti-replay protection with version enforcement
  • At-rest encryption via OS keychain (DPAPI, Keychain, libsecret)

Bundle Composition

Each policy resolves to a concrete bundle: a specific client version, a set of plugins at pinned versions, configuration overrides, and post-install steps — all verified by SHA256 checksums.

  • Client release pinning by version or constraint
  • Plugin versions with dependency resolution
  • Post-install steps: model downloads, config writes, setup scripts
  • Incremental updates — only download what changed

Group-Based Targeting

Assign policies to groups, roles, or individual users. When a user belongs to multiple groups, policies merge deterministically — plugins are unioned, restrictions follow most-restrictive-wins.

  • Native groups or SCIM-synced from the IdP
  • Priority-based merge for conflicting settings
  • Most-restrictive-wins for security restrictions
  • Policy preview before publishing

Phased Deployment

Roll out changes in phases — canary to 5%, then engineering, then everyone. Success criteria gate each phase. If error rates spike, the system pauses and optionally rolls back automatically.

  • Canary, phased, scheduled, and immediate strategies
  • Success criteria: min success rate, max error rate
  • Auto-proceed or manual approval between phases
  • One-click rollback to previous policy

Compliance Monitoring

Every enrolled device reports its state on a configurable interval. The dashboard shows compliance percentage, drift events, stale devices, and deployment progress — all auditable.

  • Real-time compliance status per device
  • Drift detection with configurable remediation
  • Stale device tracking and auto-unenrollment
  • Full audit log for SOC 2 and ISO 27001

MDM Enforcement

When an organisation requires managed installation, the server blocks unenrolled clients. Three enforcement modes allow gradual rollout: audit first, then partial, then full.

  • Org-level mdm_required flag
  • Audit, partial, and full enforcement modes
  • Configurable grace period for new users
  • Device attestation tokens on every request

On-Device Content Detection

A local ML model flags sensitive content before it reaches any AI provider. Runs entirely on the device with configurable inference mode (auto, GPU, CPU).

Training Opt-In

Local model training is off by default. Activation requires explicit user consent with EULA acceptance. No silent enrolment.

Encrypted Local State

Policy snapshots and plugin validation state encrypted at rest via OS keychain (DPAPI on Windows, Keychain on macOS, libsecret on Linux).

Vendor and Model Restrictions

Policies define which AI providers and models users can access. Everything outside the allowlist is blocked at the application level.

Phased rolloutsQ2/Q3 2026

Progressive deployment with automatic rollback

Create a deployment, pick a strategy, and define success criteria. The scheduler rolls out the policy in phases. Each phase waits for enough devices to report success before proceeding.

If error rates exceed the threshold, the deployment pauses automatically. One click rolls back to the previous policy. Every device, every phase, every error is logged for audit.

Adaptive sync intervals speed up during active deployments and throttle back during steady state — no bandwidth storms, no thundering herds.

Canarycomplete
5% of engineering
8/8 devices
Engineeringactive
All engineers
41/79 devices
Everyonepending
All groups
0/162 devices

Intune / Entra ID

Push the installer MSI via Intune. Groups sync from Entra ID via SCIM. SSO for authentication.

Jamf / Apple MDM

Distribute the PKG via Jamf policies. Keychain integration for at-rest policy encryption.

Ansible / SCCM

Automate with DEB/RPM packages. Silent mode for headless deployment. Scripts for detection.

SCIM Sync

Groups and users sync from the Identity Provider. Policy targeting mirrors the AD structure.

< 5 minUser onboarding
100%Compliance visibility
1-clickRollback capability
ZeroUnmanaged installations

LLM Usage Analytics

Per-vendor, per-model usage breakdown. Which teams use which models, how often, and for what types of tasks.

OpenTelemetry

Every tool invocation instrumented with latency histograms and invocation counters. Export to Grafana, Jaeger, Datadog, or any OTLP-compatible backend.

Audit Trail

Agent decisions, proposals, votes, and knowledge changes logged with full provenance. Structured for SOC 2 and ISO 27001 reporting.

Flow Coverage

380 application flows mapped across 23 domains. Every user action routed through a structured event channel for consistent observability.

AI Governance

Clause 5

Structured proposals, consensus voting, role-based agent identity, and remit enforcement. All decisions recorded with provenance.

Risk Management

Clause 6.1

Plan gates, milestone verification, dependency tracking, and health monitoring across multi-phase programs.

Data Management

Annex A.7

On-device content detection, vendor and model restrictions, encrypted policy state, and explicit training opt-in.

Monitoring & Measurement

Clause 9

LLM usage analytics, OpenTelemetry instrumentation, per-vendor breakdowns, and flow coverage across 23 domains.

Audit & Accountability

Clause 9.2

Full audit trail of agent decisions, knowledge changes, ticket transitions, and governance actions. SOC 2 and ISO 27001 compatible.

Continual Improvement

Clause 10

Versioned knowledge base with review workflows, drift detection, and policy simulation before deployment.

Drift detectionQ2/Q3 2026

Continuous state comparison against policy

The policy agent on each device continuously compares actual state to desired state. If a user uninstalls a required plugin, changes a locked setting, or installs an unapproved extension — the dashboard shows it within minutes.

Remediation is configurable per restriction: auto-fix silently, warn and fix, report to admin, or block the app until resolved. IT controls the trade-off between user freedom and organisational compliance.

Compliant
Settings match policy, plugins present and verified
Drift
Locked setting changed or required plugin removed
Error
Policy application failed — needs IT attention
Stale
Device hasn't checked in within the expected window

Talk to us about IT administration

SSO, SCIM, and policy controls are available now. Managed deployment and drift detection are shipping in Q2/Q3 2026.

Book a Call

See how Swarmix works

A walkthrough of unified visibility, governance, and intelligence across every AI vendor and team.

  • Deploy in weeks
  • Works with any existing AI stack
  • SOC 2 compliant, GDPR ready