Runbook: fleet management

Across a team, agents get installed on machines nobody registered. Fleet Control gives an enterprise a registry of every device and surfaces the ones running agents without Surfil, so coverage is a known number rather than a hope.

The device registry

Every linked device appears in the registry with its status and last check-in. Owners and admins manage the roster from the Devices screen; each device has a detail page for status and revocation.

Shadow discovery

• Coverage - which machines run a coding agent, and of those, which run Surfil.
• Gaps - agents intercepting traffic outside your control plane are the shadow set to close.
• Action - link a discovered machine with device approval, or revoke one that shouldn't be there.