How the proxy works

Three properties keep on-device TLS inspection honest and contained.

A unique certificate authority per device

Each Mac mints its own certificate authority at install time. The private key never leaves that machine — it lives in a root-owned system directory and is never uploaded — and our backend is structurally incapable of holding it. Compromising one device’s CA compromises one device, not a fleet. (This is also why the CA certificate profile is per-device.)

Interception is constrained to the catalog

The certificate is name-constrained to the domains in the platform app catalog — AI tools, cloud storage, webmail, file transfer, paste sites, messaging, and the other monitored categories. Your bank’s website is cryptographically outside what the certificate can intercept, not merely configured out.

The same catalog drives destination groups, so the set of intercepted domains and the set of destinations rules can target cannot disagree. A destination outside the catalog is not un-policied — pastes into it are still governed by your device-wide rules — it simply is not intercepted at the network layer.

No silent green

A minted-but-untrusted certificate cannot decrypt anything, so the agent refuses to even start interception until the device actually trusts the CA — and it reports which trust state it is in on every check-in. There is no way for a device to end up looking healthy while inspecting nothing: either interception is running against a trusted certificate, or the console shows you exactly why not.

How trust gets established — the employee-approved default and the MDM-enforced upgrade — is the subject of CA trust tiers.