Policies & IT
Everything IT needs to manage AI tooling across the organisation.
The problem
Without central control, every user installs different versions, skips plugins, picks their own models, and changes settings. IT can't see what's running, can't enforce standards, and can't prove compliance.
Identity
Users authenticate through the existing identity provider. Groups and memberships sync automatically via SCIM 2.0. Deprovisioning follows the IdP lifecycle.
Google, Microsoft, SAML 2.0, OpenID Connect. Any standards-compliant identity provider.
Automated user and group sync. Tested with Okta, Azure AD, and OneLogin. Users and groups create, update, and deprovision automatically.
Policies assign to groups synced from the IdP. No manual user-to-policy mapping required.
Soft deactivate (preserves data, user can be re-provisioned) or full removal (revokes sessions, deletes memberships, removes from groups).
Users link multiple SSO providers to one identity. Switching identity providers does not create duplicate accounts.
Sessions are scoped per device. Revoking one device does not affect others. Brute-force protection on all auth endpoints.
The light installer
A 10 MB installer that authenticates via SSO, fetches an encrypted policy, and provisions the complete environment. IT distributes it through their existing MDM — Intune, Jamf, or any deployment tool.
The installer opens the organisation's SSO provider (Entra ID, Okta, Google) in the system browser. No credentials are stored locally. Auth happens before any software is downloaded.
After authentication, the installer requests the user's resolved policy from the Swarmix server. The policy is encrypted and signed — tailored to the user's group membership and role.
The installer downloads the client app, plugins, and models specified by the policy. Every artifact is SHA256-verified. Post-install steps configure embeddings, vector stores, and plugin settings.
The device exchanges cryptographic keys with the server and registers for ongoing policy management. From this point, the client's built-in policy agent handles updates automatically.
The client app starts with everything configured. The user is productive immediately — the right plugins, the right models, the right settings. No manual setup, no guesswork.
Inside a policy
A policy is a declarative specification: which client version, which plugins, which models, which settings — and who gets it.
Policy engine
Encrypted policy documents, bundle composition, group targeting, phased deployment, compliance monitoring, and MDM enforcement.
Policies are signed with Ed25519 and encrypted per-device with AES-256-GCM. The server resolves, merges, and delivers each user's policy after authentication. No plaintext policies on disk.
Each policy resolves to a concrete bundle: a specific client version, a set of plugins at pinned versions, configuration overrides, and post-install steps — all verified by SHA256 checksums.
Assign policies to groups, roles, or individual users. When a user belongs to multiple groups, policies merge deterministically — plugins are unioned, restrictions follow most-restrictive-wins.
Roll out changes in phases — canary to 5%, then engineering, then everyone. Success criteria gate each phase. If error rates spike, the system pauses and optionally rolls back automatically.
Every enrolled device reports its state on a configurable interval. The dashboard shows compliance percentage, drift events, stale devices, and deployment progress — all auditable.
When an organisation requires managed installation, the server blocks unenrolled clients. Three enforcement modes allow gradual rollout: audit first, then partial, then full.
Data protection
Sensitive content is flagged locally before reaching any AI provider. Policy state and plugin validation are encrypted at rest using the OS keychain. Training capabilities require explicit opt-in.
A local ML model flags sensitive content before it reaches any AI provider. Runs entirely on the device with configurable inference mode (auto, GPU, CPU).
Local model training is off by default. Activation requires explicit user consent with EULA acceptance. No silent enrolment.
Policy snapshots and plugin validation state encrypted at rest via OS keychain (DPAPI on Windows, Keychain on macOS, libsecret on Linux).
Policies define which AI providers and models users can access. Everything outside the allowlist is blocked at the application level.
Phased rolloutsQ2/Q3 2026
Create a deployment, pick a strategy, and define success criteria. The scheduler rolls out the policy in phases. Each phase waits for enough devices to report success before proceeding.
If error rates exceed the threshold, the deployment pauses automatically. One click rolls back to the previous policy. Every device, every phase, every error is logged for audit.
Adaptive sync intervals speed up during active deployments and throttle back during steady state — no bandwidth storms, no thundering herds.
Works with the existing stack
The device MDM handles the device. Swarmix policies handle the application. The installer is an MSI, PKG, or DEB, distributed the same way as everything else.
Push the installer MSI via Intune. Groups sync from Entra ID via SCIM. SSO for authentication.
Distribute the PKG via Jamf policies. Keychain integration for at-rest policy encryption.
Automate with DEB/RPM packages. Silent mode for headless deployment. Scripts for detection.
Groups and users sync from the Identity Provider. Policy targeting mirrors the AD structure.
The outcome
Monitoring
Per-vendor and per-model usage breakdown, OpenTelemetry instrumentation on every tool invocation, and a full audit log of agent decisions and knowledge changes.
Per-vendor, per-model usage breakdown. Which teams use which models, how often, and for what types of tasks.
Every tool invocation instrumented with latency histograms and invocation counters. Export to Grafana, Jaeger, Datadog, or any OTLP-compatible backend.
Agent decisions, proposals, votes, and knowledge changes logged with full provenance. Structured for SOC 2 and ISO 27001 reporting.
380 application flows mapped across 23 domains. Every user action routed through a structured event channel for consistent observability.
Compliance
ISO/IEC 42001 is the international standard for AI management systems. These are the clause areas it requires and where Swarmix provides supporting infrastructure.
Clause 5
Structured proposals, consensus voting, role-based agent identity, and remit enforcement. All decisions recorded with provenance.
Clause 6.1
Plan gates, milestone verification, dependency tracking, and health monitoring across multi-phase programs.
Annex A.7
On-device content detection, vendor and model restrictions, encrypted policy state, and explicit training opt-in.
Clause 9
LLM usage analytics, OpenTelemetry instrumentation, per-vendor breakdowns, and flow coverage across 23 domains.
Clause 9.2
Full audit trail of agent decisions, knowledge changes, ticket transitions, and governance actions. SOC 2 and ISO 27001 compatible.
Clause 10
Versioned knowledge base with review workflows, drift detection, and policy simulation before deployment.
Drift detectionQ2/Q3 2026
The policy agent on each device continuously compares actual state to desired state. If a user uninstalls a required plugin, changes a locked setting, or installs an unapproved extension — the dashboard shows it within minutes.
Remediation is configurable per restriction: auto-fix silently, warn and fix, report to admin, or block the app until resolved. IT controls the trade-off between user freedom and organisational compliance.
SSO, SCIM, and policy controls are available now. Managed deployment and drift detection are shipping in Q2/Q3 2026.
A walkthrough of unified visibility, governance, and intelligence across every AI vendor and team.