> ## Documentation Index
> Fetch the complete documentation index at: https://docs.befailproof.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Choose your setup

> Choose local enforcement, Failproof AI Cloud, or an enterprise deployment.

<CardGroup cols={3}>
  <Card title="Local enforcement" icon="laptop">
    Install hooks and policies on a machine. Use this when you need immediate guardrails without sending session data to Cloud.
  </Card>

  <Card title="Failproof AI Cloud" icon="cloud">
    Add centralized sessions, audits, online evaluations, dashboards, alerts, and fleet policy deployment.
  </Card>

  <Card title="Enterprise deployment" icon="building-2">
    Use organization controls, scoped keys, private infrastructure, and deployment-specific security requirements.
  </Card>
</CardGroup>

## Recommended production path

1. Connect a non-production machine with transcript capture enabled.
2. Verify sessions and evaluations in Cloud.
3. Create an audit for a known failure mode.
4. Deploy the first policy in observe mode.
5. Expand to production after reviewing matches and false positives.

## Connect a machine to Cloud

<Tabs>
  <Tab title="Dashboard">
    1. Go to **Administration → Keys** and create a key with `events:add` and `policies:pull`.
    2. Copy the one-time secret to the target machine.
    3. After running the CLI connection command, go to **Admin → enforcement** and confirm the machine appears.
    4. Go to **Observe → Events** and confirm its first event arrives.

    The key drawer shows the two grants needed by a connected machine: event ingestion and policy delivery.

    <img src="https://mintcdn.com/exosphere/WgPwQzedeDNwJBTy/images/dashboard/key-create.png?fit=max&auto=format&n=WgPwQzedeDNwJBTy&q=85&s=a428bdae79f837471acb66414ff6455b" alt="The new API key drawer used to grant event ingestion and policy delivery permissions." width="2940" height="1604" data-path="images/dashboard/key-create.png" />

    After connection, the machine should appear in enforcement with its desired and reported policy state.

    <img src="https://mintcdn.com/exosphere/WgPwQzedeDNwJBTy/images/dashboard/enforcement-fleet.png?fit=max&auto=format&n=WgPwQzedeDNwJBTy&q=85&s=96be13256ef7e3fa89eeefcc4f1b7f10" alt="The Enforcement fleet with an enrolled machine expanded to show its desired policy state and deployment status." width="2938" height="1600" data-path="images/dashboard/enforcement-fleet.png" />

    The first arriving event confirms that the daemon can deliver data to Cloud, independently of policy deployment.

    <img src="https://mintcdn.com/exosphere/WgPwQzedeDNwJBTy/images/dashboard/events-stream-current.png?fit=max&auto=format&n=WgPwQzedeDNwJBTy&q=85&s=e87ba86b877f602de73237d5a3565269" alt="The live event stream showing recent agent, model, and tool events." width="2940" height="1618" data-path="images/dashboard/events-stream-current.png" />

    Continue only after both the machine and its first event are visible.
  </Tab>

  <Tab title="CLI">
    ```bash theme={null}
    failproofai config --connect https://app.befailproof.ai \
      --token "$FAILPROOFAI_KEY" \
      --machine-label checkout-runner-01

    failproofai policies --install --cli claude --scope user
    failproofai config --status
    ```

    Add `--no-transcripts` when transcript content must remain local.
  </Tab>
</Tabs>

Connecting to Cloud verifies event ingestion and policy delivery independently. A key may therefore be valid but missing one required permission. Use `failproofai config --status` to see which capability is configured.

<Info>
  Cloud setup writes local credentials only after the relevant capability succeeds. A failed verification does not leave a machine looking connected when it is not.
</Info>