Flanner Mesh

Access is per person. An admin grants you a role in a workspace. The grant reaches every machine you have enrolled when your entitlement next renews — within a day, or immediately if you run flanner whoami --refresh.

Binding is per repository. Run flanner join in a repository to bind it to a workspace. Until you do, plans in that repository stay local, even if you have access to the workspace.

A workspace is not a repository. It is the boundary that decides who sees what. One workspace can hold many repositories, and everything in it syncs as one set.

With Flanner Curb, your organization can publish one policy for its coding agents. Each device checks it, and writes it into Claude Code's and Codex's own settings. This needs a Flanner Mesh account. Unlike syncing, it needs no subscription: it is in the free plan.

A policy is written once, in Curb's own terms, and each device turns it into what each agent understands.

Signed, and checked on the device. Your organization signs each policy version. A device trusts one only when it verifies against a current policy key, and the list of those keys is itself signed by the key that already signs your entitlement.

A device refuses an older version, the same version with other contents, another organization's policy, a policy signed by an unknown or revoked key, and an expired one. Each refusal is alerted, and the policy in force stays in force.

An expired policy stays in force, flagged as expired. So does one whose signing key is revoked later. A device never falls back to weaker settings on its own.

The delegation. Enrolling asks your operating system once. After that, a policy change that only tightens applies on its own. “Only tightens” is judged on your device, by the same tighten-only rule as a fix. Enrolling also adds a hook that checks the policy again at each session start. --withdraw ends the delegation at any time.

Why some changes wait. Anything else waits for --approve: a change that would open a channel wider, one whose effect Curb cannot work out, and every change for an agent version Curb has not tested. You see the exact change, your operating system asks, and each file is backed up for 7 days. So a stolen or mistaken policy can tighten your settings, and nothing more, without you.

Your console can preview a policy change. It cannot decide one: only the device can see its own settings, so each device decides for itself.

Drift is a policy rule that the settings in effect no longer meet. Somebody edited a file, or device management delivered something else. An enrolled device reads its settings against the policy again at each session start, and when Claude Code reports a settings change. While flanner peer serve runs, it also does so when Codex's config file changes, and every 6 hours.

These checks read each agent as it starts outside any project. A project's own settings and .env files are not part of drift, the fleet view or alerts.

What a device reports. After each check, the device signs a small report and sends it to your organization. It holds the device id, a sequence number, the time, each agent's name and version, the policy state, and counts: of launches by severity, and of secrets by exposure class from the last leak sweep.

It holds no path, no username, no hostname, no repository name and no fingerprint of a secret. The policy state is version numbers, the policy's hash, whether the delegation is on, and whether there is drift.

A report that cannot be sent waits on the device for up to 7 days. Your organization keeps each device's newest report and 30 days of history, and deletes them when the device is removed.

An enrolled device raises an alert when an agent can reach more than before, and when a policy is refused:

• an MCP server was added
• a deny rule was removed
• the sandbox was turned off
• a secret was sent to a model provider
• an org policy was refused, failed its integrity check, or was an older one
• a key registry was refused

You hear at once, by desktop notification and at your next session start. Admins hear through a webhook or Slack destination set in the console, if your organization has one. The first check only records what is there: nothing has changed yet.

An alert holds its type, the agent, a severity, a keyed fingerprint of what changed, and a category such as “Claude Code MCP settings”. Never a path or a name. The relay adds the device's label.

One alert per change. Each has a stable id, so a retry sends the same one. The relay drops an id it delivered in the last 7 days, and each webhook delivery carries the id in a Flanner-Event-Id header and an HMAC in Flanner-Signature, so a receiver can drop repeats and check the sender.