What Gets Installed

Every AgenShield component that lands on a Mac, what each one is responsible for, where it lives, the approvals macOS requires, and how to confirm it is healthy.

Installing AgenShield puts a small, fixed set of components on the Mac. Nothing here needs configuring by hand — the installer places it all — but security and IT teams reviewing the software should know exactly what is present, and support needs a shared vocabulary for it.

The components

AgenShield app

The menubar app and dashboard. Shows system status, the agents detected on this Mac, sign-in, and the approvals macOS needs a person to grant.

Background service

Always on. Applies the policy your organization publishes in the Frontegg Portal, keeps the record of what agents did, and reports device health.

Security extension

An Apple Endpoint Security extension. Decides whether an agent may run a program or open a file, following the agent’s execution tree.

Network extension

An Apple Network Extension hosting two providers: a content filter that decides which destinations agents may reach, and a transparent proxy that carries the connections selected for network inspection.

Command-line tool

The agenshield command: setup, status, diagnostics, upgrade, uninstall.

Managed configuration

Your organization’s signed policy, delivered from the Frontegg Portal. Administrator-only on the device.

Responsibilities

Component	Responsible for	Not responsible for
AgenShield app	Showing status; sign-in; surfacing approvals macOS requires	Making policy decisions
Background service	Fetching and applying policy; recording activity; reporting device health	Deciding individual file or network operations
Security extension	Allowing or blocking what an AI agent executes and reads	Anything you or your other applications do
Network extension	Allowing or blocking where an AI agent connects — its content filter makes the decision, its transparent proxy carries inspected traffic	Your own browsing or non-agent traffic
Command-line tool	Setup, status, diagnostics, lifecycle	Running in the background

Enforcement applies to AI agents and the processes they start — not to you as the person using the Mac. AgenShield deliberately cannot block the system processes macOS needs to function; that limit is compiled into the signed security extension and cannot be changed by policy, by an administrator, or by anyone with access to the device. See How AgenShield works.

Where things are installed

Path	What it is
/Applications/AgenShield.app	The app, the dashboard, and both extensions
/Library/AgenShield/	The background service and command-line tool
/opt/agenshield/	Managed configuration (administrator-only)
/etc/agenshield/	Additional protection configuration (administrator-only)
~/.agenshield/	Per-user settings, credentials, local records
/var/log/agenshield/	Service logs

Both extensions ship inside the app bundle. That is why the app must stay in /Applications — moving or renaming it stops enforcement.

~/.agenshield/ holds this device’s enrollment credentials. It is created owner-only — do not loosen its permissions, copy it between machines, or commit it to a repository.

The three approvals macOS requires

macOS will not let any security product enable itself silently. On a Mac that is not MDM-managed, someone with administrator rights must grant three approvals, once: the system extensions, Full Disk Access for the security extension, and the “Filter Network Content” prompt. agenshield activate walks through all three and detects each as you grant it — the Quickstart shows the exact System Settings paths.

On MDM-managed Macs your administrator pre-approves all three and nobody is prompted — see the MDM deployment guide.

Confirming everything is healthy

agenshield status

A healthy Mac reports Status: ✅ Healthy — the background service running, your organization’s policy received and recently synced, both extensions enforcing, and the AI agents found on this Mac listed in the inventory.

The menubar icon shows the same at a glance as a colored status dot — see The AgenShield app for what each color means and for the dashboard behind it.

If something is not right, start with Common issues.

Removing AgenShield

agenshield uninstall

No sudo needed — the command asks for your administrator password itself. This removes every component above, including the extensions and the managed configuration. See Install and uninstall for what is left behind and how to verify removal.