Onboarding

When setup ends it prints the console’s address and the setup words. Open the address, sign in with the temporary password mailed to you, set your own, and register your passkey. You are the first keeper, and you land on onboarding.

Each screen shows its defaults already chosen. Next accepts them. Skipping a screen keeps its defaults, and every choice remains a row in Settings afterwards.

1. You

Your name and your passkey, which is registered by now. You may add a spare passkey; it is offered, never required. You may also invite a co-founder as a second keeper.

2. What to watch

• Accounts. An organization is detected and all of its accounts are watched by default. Only these narrows the boundary.
• Regions. The regions your accounts have enabled.
• Clusters. The clusters found, all ticked, with the access-entry check for each. See Install checks.
• Schedule. Every day at 06:00 UTC.
• Network sensor. Off, with its price shown before you turn it on.

The hub account and the cluster Warden runs in are always ticked.

3. Agents

A Check button per role confirms Bedrock model access, and the model per role comes from what your account has enabled. The daily budget shows the month’s price. Run rules-only for now is a first-class choice: the watch is the same, and every page says the agents are off. See Bedrock access.

4. Alerts

Your address is fixed. It is where the readback and every waiting change are mailed. You may add more e-mail addresses for alarms and reports, a Slack webhook (optional; Send test works once it is in effect), a time zone and a digest day.

5. Defend and license

Watch only is the default. You may instead turn on Defend, choosing its classes and limits, and one of two ways:

• Turn on in 72 hours, no terminal (default). After the review, the console asks for one more passkey touch to sign the Defend request, and shows its 72-hour wait.
• Turn on now with a terminal check. Install shows the command to run in a terminal first.

Defend prepares a plan that a keeper signs with a passkey. Turning it on does not let it act on its own.

Then add your license (download the Watch license from your account on this site), or skip it: the watch runs unlicensed, and changes stay off until you add one. See Licensing.

Review, and one signature

The review lists every choice as one line, grouped by screen. You type the setup words and sign once with your passkey. That one signature sets all of it: it is the install’s first record, carrying your alert channels, egress hosts, models, invitation, license and policy choices, and Defend only when you chose the terminal check.

If you would rather work in a terminal, the setup command offers the same step below the fold under “Prefer to do this in a terminal?”.

If you lose the console or its door before you finish, see Recovery.