Deployment Options
Option 1: Cloud-Hosted (SaaS)
Section titled “Option 1: Cloud-Hosted (SaaS)”Your Applications → AgentWatch Cloud → LLM Providers- Fastest deployment (minutes)
- Managed by AgentWatch team
- Automatic updates and scaling
Option 2: Self-Hosted (On-Premise)
Section titled “Option 2: Self-Hosted (On-Premise)”Your Applications → AgentWatch (Your Infrastructure) → LLM Providers- Data never leaves your network
- Full control over configuration
- Air-gapped deployment option
Option 3: Hybrid
Section titled “Option 3: Hybrid”Your Applications → AgentWatch (Your DMZ) → LLM Providers ↓ AgentWatch Cloud (Analytics)- Request processing on-premise
- Analytics and dashboards in cloud
Traffic Steering: Connect Client vs DNS Redirector
Section titled “Traffic Steering: Connect Client vs DNS Redirector”Separate from where AgentWatch runs (above) is how employee AI traffic reaches it. There are two mechanisms, and most enterprises use both — they cover different halves of the problem.
| Connect client (per-machine agent) | DNS Redirector (network) | |
|---|---|---|
| How it steers | Installs an agent that redirects AI domains on the device | One DNS change on the router — covers the whole LAN |
| TLS trust | Installs its own certificate authority per machine | Root CA pushed separately via MDM/GPO |
| Per-user identity | Yes — identifies each employee automatically | Organization-level (or per-user on an on-prem gateway) |
| Endpoint install | App on every Windows/Mac/Linux device | Nothing on endpoints (just certificate trust) |
| Device coverage | Only devices you can install software on | Every device on the network — BYOD, Linux, IoT, phones, unmanaged |
| Roaming laptops (off-network) | Protected everywhere (home, café, travel) | Only while on a network using AgentWatch DNS |
When to use the DNS Redirector
- You need to cover unmanaged or BYOD devices you can’t install an agent on.
- You want the fastest possible rollout — one DNS entry instead of deploying an agent fleet.
- The traffic is on an office/site network whose DNS you control (on-prem or cloud gateway).
When to keep the Connect client
- You need reliable per-user attribution for every employee (behind one shared internet connection, the network path can only attribute at the organization level).
- You must protect roaming laptops that leave the corporate network.
Important: With either method, AgentWatch inspects HTTPS content only after the AgentWatch root certificate is trusted on the device (pushed centrally via MDM/GPO — not a per-machine app). This is the same trust model used by Zscaler and Netskope. Without it, AgentWatch can see which AI services are used and how much data flows, but not the content.
Encrypted DNS (managed devices). The DNS Redirector also speaks encrypted DNS (DNS-over-HTTPS and DNS-over-TLS). For managed Mac, iOS, and Android devices you push a DNS profile via MDM that points the device’s system resolver at AgentWatch — so AI-domain steering applies everywhere the device goes, including home Wi-Fi and cellular, with nothing installed but a configuration profile. Ready-to-use Apple profiles are provided.
The DNS Redirector ships as a standalone Docker container. See the deployment reference and dns-server/README.md.
Enrollment Portal — onboarding employees & guests (no pre-known emails)
Section titled “Enrollment Portal — onboarding employees & guests (no pre-known emails)”A tenant-branded captive/enrollment portal (/portal) is the front door for getting devices enrolled. A device joining the network is steered to the portal, the person identifies themselves (SSO, an emailed one-time code, an allow-listed email, or just a name), and installs the right artifact for their OS — Connect client on managed machines, a lightweight configuration profile on guests/BYOD. Network access is granted when the device enrolls (trusts the inspection certificate); the identity step controls how strongly the traffic is attributed to a person.
- How the portal appears on join: point the network’s DNS at AgentWatch and enable captive steering (nudge-to-enroll, no controller changes), or wire your Wi-Fi controller’s captive portal to
/portalfor hard “block-until-enrolled”, or run AgentWatch inline. Your existing router/default gateway is unchanged. - Guests vs employees: guests use a keyless profile they consent to (removable on their own device); managed employees get the Connect client via MDM (locked, auto-identified from their corporate login).
- Bulk push (100s of devices): one templated MDM profile attributes per-user automatically — no per-person file generation.
Full IT/network setup — the three deployment models, NAC admit callbacks with sample payloads, inline-gateway Docker, and bulk MDM — is in AgentWatch_Endpoint_Enrollment_Guide.md.