On-Premises Personal Agents
Run your own personal-agent platform on your own servers, giving each employee or customer a personalized agent that remembers them and acts for them within the permissions you set.
Set one security policy for AI agents across managed desktops
FinShield is the desktop security guard for AI agents. Built on FinSafe, it runs supported agents inside a sandbox with rules for files, programs and network access. For an enterprise fleet, a Policy Authority and operator console issue enrollment tokens for desktops, assign signed policies to device groups and show reported device status and managed-run records. Those policies apply when agents are started through managed FinShield—not to every app on every computer. A Forward Deployed Engineer (FDE) can help your IT and security teams deploy and operate the system.
Personal FinShield is free for anyone to install on their own desktop. Enterprise Agent Security Guard is a separate enterprise edition for managed fleets.
- Only enrolled desktops become part of the managed fleet.
- Signed policy bundles can be assigned by device group and rollout.
- Operators can review check-ins, reported policy, runs and audit events.
Managed fleet mode
Enterprise Agent Security Guard is FinSafe in managed fleet mode: enrolled desktops, a Policy Authority you operate, and signed policy bundles assigned by device group. Managed fleet operation and the Policy Authority are licensed with a Finogeeks-issued license that sets the maximum number of enrolled devices.
Operator console
The admin console shows enrollment, heartbeats, reported policy bundles, managed-run records and audit events so security and IT teams can run rollout and review.
How managed runs are governed
An enrolled desktop verifies its assigned policy; managed FinShield applies it locally through FinSafe when a supported agent is launched.
The operator loop
Roll out policy in stages; enforcement happens on enrolled desktops.
What operators can manage
- Devices and groups: Review enrollment, health, last check-in and each device's reported bundle.
- Policy rollout: Publish signed bundles, assign device groups and stage a rollout.
- Run and audit signals: Review available managed-run records, policy denials and reported alerts.
- Device controls: Revoke or pause a device.
- Policy confirmation: Policy updates need confirmation on the employee's device. If the person chooses Later or dismisses the prompt, reminders repeat hourly until the update is applied.
- Stop managed agents: Operators can stop current Desktop-managed agents once per policy group or device, without changing that device's authorization. This is not the same as revoking or pausing a device.
- Protection events: Protection events are stored locally, and enrolled Management can upload them incrementally.
Visibility follows the managed path
The console can show device enrollment and last heartbeat, the bundle a device last reported, and run or audit events emitted by managed FinShield paths. The exact records depend on platform, agent integration and configuration. Records cover runs started through managed FinShield; other apps are outside scope. Operational records may contain sensitive business information, so agree who can review them and how they are handled before rollout.
Evaluation
How we evaluate desktop controls
We publish a public, case-driven project that evaluates agent safety controls and sandbox enforcement—not model skill. FinShield is one of the protection tracks. Browse hosted demos, or clone the repo to rebuild reports offline.
Two products behind the solution
Personal FinShield is free for anyone to install on their own desktop. Enterprise Agent Security Guard is a separate enterprise edition for managed fleets.
Deploy with your IT and security operators
An FDE helps your team choose a pilot group and supported agent paths, connect endpoint deployment to the Policy Authority, and configure policy bundles and device groups. Together, you verify enrollment, enforcement and the records visible to operators before expanding rollout. The engagement should leave your team with documented ownership for policy changes, device updates, event review and emergency response; your operators use the console for ongoing fleet administration.
Common questions
What does “fleet” mean here?
It means the desktops enrolled with your organization’s Policy Authority and licensed for managed fleet operation. Unenrolled machines are outside the governed boundary.
Does the policy cover every agent or application on a desktop?
No. It governs supported runs started through the organization’s managed FinShield entry point. Other applications and direct launch paths need separate controls if they must be restricted.
What can operators see?
The console can show enrollment, last check-in, the latest reported policy bundle, managed-run records, audit events and policy denials. Available detail depends on the platform, integration and configuration.
Does the console record every conversation?
Records cover runs started through managed FinShield; other apps are outside scope. Some operational records can contain business content. Define access and handling rules with your security and privacy teams.
How is the solution licensed?
Managed fleet operation and the Policy Authority are licensed with a Finogeeks-issued license that sets the maximum number of enrolled devices.
Next step
Start with a small fleet and a policy you can verify.
Choose a pilot group, confirm the agent launch paths and operator signals, then expand only after the boundary works for the tasks people need to do.