Overview
Agentic Security is a monitoring and security tool that helps you keep track of AI agent activity on your devices. It provides real-time event streaming, action risk classification, and audit logging — giving you visibility into what AI agents like OpenClaw are doing on your machine.
This guide walks you through setting up Agentic Security as a consumer user.
If your organization already uses Swif for device management (MDM), you can enable Agentic Security directly from your existing Swif workspace — no separate sign-up required. Learn more at Getting Started with Agentic Security for Enterprise (Swif Organizations).
What You'll Need
A computer running Mac, Windows or Linux.
An internet connection
About 5 minutes
Supported Platforms
Platform | Installer | Architectures |
macOS | Signed and notarized | Apple silicon and Intel |
Windows | Signed | x64 and ARM64 |
Linux |
| x64 and arm64 |
Standalone installers are also available: a .zip for macOS, an .exe for Windows, and a binary for Linux.
Installing Agentic Security
Step 1: Create Your Account
To get started, sign up for a Agentic Security account at the dedicated registration page.
Global: app.swif.ai
EU: app.eu.swif.ai
During sign-up, you'll be asked a few onboarding questions to help personalize your experience — things like your name and how you plan to use Agentic Security. Fill in all the required fields and click Continue to proceed.
Step 2: Install the Agentic Security Agent
After completing the onboarding questions, you’ll be prompted to install the Agentic Security agent.
1. Select your installer. Choose your operating system from the dropdown menu.
2. Download the installer. Click Download Installer. The button is available once you’ve selected an installer.
3. Run the installer. It installs the agenticsecurity-install command on your device.
OS | How to install |
macOS | Double-click the |
Windows | Double-click the |
Linux | Run |
4. Enroll your device. Open Terminal (macOS or Linux) or an administrator Command Prompt (Windows), and run the command below with your details. Your Team ID is shown in Settings > Team.
macOS and Linux:
sudo agenticsecurity-install -teamId=<TEAM_ID> -name=<FIRST_NAME> -surname=<LAST_NAME> -email=<EMAIL>
Windows:
agenticsecurity-install -teamId=<TEAM_ID> -name=<FIRST_NAME> -surname=<LAST_NAME> -email=<EMAIL>
All four values are required. The command enrolls your device and starts the Agentic Security agent in the background.
5. Confirm installation. Click I’ve Installed Agentic Security to continue.
Tip: To set up Agentic Security later, click Skip Setup to go to your dashboard. You can install the agent from the dashboard at any time.
Check that your device is enrolled
OS | Run this | You should see |
macOS |
|
|
Windows |
|
|
Linux |
|
|
Your device also appears in your Agentic Security device list. Once the Swif AI Agent Activity Monitoring Policy is on, sessions from Claude Code, Cursor, and Codex appear in your dashboard within about an hour.
If enrollment fails
“team … is not valid”: check your Team ID, then run the command again.
Already enrolled: running the installer again doesn’t enroll the device twice or create a duplicate.
Logs:
macOS:
/var/log/agentsecurity.logWindows:
C:\Program Files\AgentSecurity\logs\log.txtLinux:
/var/log/agentsecurity.log, orjournalctl -u agentsecurity-agent
Step 3: Enable Monitoring Policies
Agentic Security uses policies to decide which activity to monitor on your device. In this step, you turn on the required policies with a toggle. No other configuration is needed.
Swif Agent Inventory Policy: finds autonomous AI agents on your device, such as Hermes and Grok Bot, and reports how they’re set up.
Swif OpenClaw Tools Access Policy: controls which tools OpenClaw agents can use, starting with a minimal profile.
Turn on the required policies, and click Continue. The button becomes available once the required policies are on.
Managing Your Policies
Your policies define what Agentic Security monitors on your device. You can create and assign them from two places.
From the Activity Tab
Open an Agentic Security-enrolled device from the device list.
Go to the Activity tab.
If no policy exists, you'll see a Missing Policy state.
Click Create/Assign Inventory Policy.
The tab refreshes to show the new policy status.
From the Policies Tab
Open an Agentic Security-enrolled device.
Go to the Policies tab.
If the policy shows Not Configured, click Create Policy.
The status changes to Not Assigned or Enabled, depending on your setup.
Policy states
Status | Meaning | Action |
Not Configured | The policy hasn't been created yet | Click Create Policy |
Not Assigned | The policy exists, but isn't applied to this device | Click Assign Policy |
Enabled | The policy is active | Click Configure Policy to adjust it |
For details, see:
Swif Agent Inventory Policy: finds autonomous AI agents on your device, such as Hermes and Grok Bot, and reports how they’re set up.
Swif OpenClaw Tools Access Policy: controls which tools OpenClaw agents can use, starting with a minimal profile.
Step 4: Monitor AI Agent Activity
Once Agentic Security is installed and policies are enabled, you can monitor AI agent activity from the Agentic Security tab in your device details. From here you can:
Stream events in real time — Watch AI agent actions as they happen on managed devices.
Filter activity — Filter events by subsystem (agent, gateway, hooks, browser, etc.), risk level, and time range.
Review risk classifications — Every action is tagged as Safe, Risky, or Danger so you can focus on what matters.
View device details — See encryption status, OS version, and last connected time.
What You Can Do with Agentic Security
Once you're set up, your Agentic Security dashboard gives you access to:
Real-time event streaming — See AI agent actions as they happen on your device, powered by live updates.
Action risk classification — Every agent action is automatically tagged as Safe, Risky, or Danger based on what it does (e.g., reading a file is safe, executing a command is risky, deleting a file is danger).
Activity filtering — Filter events by subsystem (agent, gateway, hooks, browser, etc.), risk level, and time range to find exactly what you're looking for.
Sensitive data redaction — API keys, passwords, and credentials are automatically detected and hidden before they appear in your logs.
Device overview — View device details including encryption status, OS version, and last connected time.
Policy management — Create and manage monitoring policies directly from the Configuration tab.
Automatic Agent Updates
Note: The Agentic Security agent updates itself on macOS, Windows, and Linux. This works for both consumer and enterprise (Swif organization) users. When a new version comes out, enrolled devices download and install it in the background, so you always have the latest protections and fixes without reinstalling.
How it works
Hands-free: You don't need to download or run a new installer. The agent finds and applies updates by itself.
Verified updates: Update packages are checked and signed before they're installed, so only genuine Swif releases go onto your device.
No interruption: Your policies and CLI privilege restrictions keep working after an update.
Check your agent version (macOS)
Open Terminal and run:
/usr/local/agentsecurity/agentsecurity --version
If the agent still shows an older version, make sure the device is online. Then wait for the next update check or restart the device.
CLI Agent Privilege Restriction & Root Protection
Agentic Security automatically enforces least-privilege guardrails on your machine to prevent CLI agents (such as openclaw) from executing commands with elevated root or sudo privileges.
How It Protects Your System
Automatic Sudo & Root Blocking: Once the Agentic Security agent is installed, running CLI agents with elevated privileges is blocked — including direct
sudo openclaw, full binary paths (e.g.,sudo /opt/homebrew/bin/openclaw), root interactive shells (sudo -s), and preserved environments (sudo -E).Uninterrupted Standard Use: AI agents continue to work seamlessly under standard user permissions, so your normal development workflows are never disrupted.
Selective Enforcement: Only monitored AI CLI binaries are restricted. Your standard administrative commands (e.g.,
sudo ls,sudo whoami,sudo cat /etc/hosts) continue to work normally.Persistent Protection: Protection rules remain active across system reboots and persist through CLI binary updates.
Multi-User Device Support: Restrictions automatically apply across all non-root accounts on the computer.
Local & Cloud Audit Logs: Any blocked
sudoattempt is logged locally (/usr/local/agentsecurity/) and displayed in the Activity tab in your web dashboard.
Removing the Agentic Security Agent
If you need to stop monitoring a device without deleting it:
Open the Agentic Security device list.
Find the enrolled device and open its action menu.
Click Remove Agentic Security Agent.
Confirm in the modal (verify the device name/serial number).
The device's Agent Status will change to Inactive.
Deleting an Agentic Security Device
To permanently remove a device from Agentic Security:
Open the Agentic Security device list.
Find the device and open its action menu.
Click Delete Device.
Confirm the deletion.
The device will be removed from the list and will no longer appear in search or filter results.
Frequently Asked Questions
Q: Which AI tools does Agentic Security monitor?
A: Agentic Security detects and monitors activity from OpenClaw CLI, OpenClaw Desktop App, Codex, and Claude.
Q: What's the difference between removing the agent and deleting the device?
A: Removing the agent sets the device to Inactive but keeps the device record. Deleting the device removes it entirely from Agentic Security.
Q: Can I use Agentic Security on BYOD devices?
A: Yes. Agentic Security supports enrollment on both corporate-managed and personal (BYOD) devices through the Consumer portal.
Q: Can I skip the installation during onboarding?
A: Yes. You can click Skip Setup during Step 2 to go directly to your dashboard and install the agent later.
Q: What happens if I don't enable the monitoring policies?
A: Without the policies turned on, Agentic Security doesn’t inventory or monitor AI agents on your device. You can turn them on at any time from your dashboard’s Configuration tab.
Q: Is Agentic Security the same as the Swif MDM agent?
A: No. Agentic Security is a separate product focused on monitoring and securing AI agent activity. It does not include enterprise MDM features like remote lock, wipe, or device fleet management. If you need enterprise capabilities, you can upgrade to the full Swif workspace from the Plans page.
Q: How do I install Agentic Security on additional devices?
A: From your Agentic Security dashboard, click Setup Installer to open the installer modal. You can also share the installation guide with others by entering their email addresses.
Q: Can I run OpenClaw or other CLI agents with sudo / root privileges?
A: No. For your safety, Agentic Security restricts CLI agents from executing under sudo or within root shells to prevent unintentional system-level modifications. You can continue running them normally as a standard user.
Q: Will Agentic Security block my regular sudo commands?
A: No. The restriction applies exclusively to monitored AI CLI tools. All other system and developer commands using sudo continue to function without interruption.
Q: Where can I see blocked privilege escalation attempts?
A: Blocked attempts are recorded locally on your device in /usr/local/agentsecurity/ and streamed directly to your Activity tab in the Agentic Security dashboard.
Q: Do I need to update the Agentic Security agent by hand?
A: No. The agent updates itself on macOS, Windows, and Linux. You only need to reinstall it if you removed it from the device.
Need Help?
If you run into any issues during setup, reach out to our support team or check the Agentic Security documentation for detailed troubleshooting steps.