How it works

Four components, and one rule: a flow is tunnelled only if an allow rule matches it. Everything else is closed without a byte being copied.

Component	Runs on	Responsibility
Agent	the device (macOS, Windows)	captures network flows at the OS layer and steers them to the Edge; enforces per-flow allow/deny locally
Edge	your infrastructure	decides every flow against policy, routes allowed ones, decrypts and inspects where configured, re-originates what it decrypted, audits the decision
Control Plane	alongside the Edge	Admin API, policy engine, identity and NHI registry, audit, OIDC — where configuration, admission and revocation are authored
Connector	inside your private network	an outbound-only bridge between the Edge and a private application — and the only way in

What happens to a request

flow arrives  →  the Edge evaluates identity, device, posture, policy

  an allow rule matches  →  tunnel to the Connector  →  local dial  →  response
  nothing matches        →  closed. No byte copied.

  either way             →  the decision is audited

Two properties are worth stating plainly, because they are the ones people ask about.

Default-deny is the default, not a mode. There is no configuration in which the absence of a rule means allowed.
Private applications are never exposed inbound. The Connector dials out to the Edge; nothing dials in. The application has no internet-facing listener to attack.

The Agent, and why it has to be on the device

The Agent runs as a macOS Network Extension, or as a Windows WFP agent with a first-party callout driver, and captures flows at the OS network layer — not as a proxy setting someone has to remember to configure. It carries an mTLS device identity, so the Edge admits a device, not merely a credential. Posture, risk state and revocation are continuous: a device can be admitted, degraded, or cut off while it is running.

This is also what makes same-LAN mediation possible at all. A cloud-only service can never see the traffic between two machines sitting next to each other.

Where TLS is decrypted — and where it deliberately is not

Interception is targeted, not blanket. Decrypting everything is both untrue as a description of this product and a red flag to anyone who has operated one.

Decrypted	Bypassed
Your own private applications — you own both ends	Major sanctioned SaaS, where bypass is the vendor's own guidance and certificate pinning makes interception a poor trade
Unknown, risky or unclassified destinations, where the threat and DLP value is concentrated	Controlled instead by tenant-restriction headers, Conditional Access and CASB APIs

Certificate-pinned hosts are proposed for bypass and never auto-bypassed. The operator decides, and the decision is visible.

How the Edge re-originates what it decrypted

When the Edge decrypts a flow it has to re-make the upstream connection itself, and that connection carries the fingerprint of whatever stack makes it. Bot management fronts a large share of the ordinary web, so a proxy re-originating with an ordinary Go client gets challenged on sites a browser reaches fine. The Edge's egress engine re-originates through a real Chrome network stack instead.

This is the Edge's own egress path, not a component beside it. It is transport only — it carries no policy, makes no decisions, and is handed a request the Edge has already decided. By default it runs as a separate service the Edge reaches over HTTP; built with the embedbroker tag it runs inside the Edge process instead. Same code either way, and the tests assert the two produce the same fingerprint so they cannot drift apart.

Two consequences we would rather state than have you discover. In its default shape a decrypt-all deployment is two processes rather than one static binary, because the engine is cgo and links a native library. And there is no silent fallback: a Go emulation is the fingerprint bot management already rejects, so falling back to one would turn a single legible failure into scattered per-origin breakage. The Edge fails the flow and reports itself unready instead.

Identity, including the non-human kind

Policy is written against identity, and identity here includes AI agents, non-human identities, MCP and delegated tool execution — in scope from the start rather than retrofitted. Delegated access grants are explicit, persisted and revocable, and out-of-band step-up approval exists for east-west access between internal systems.