Browser extensionVerify enrollment

Verifying Deployment

Complete this checklist on a managed device after pushing the extension policy. A workstation is not considered fully connected until force-install, enrollment, and event delivery are all confirmed.

Complete this checklist on a managed device after pushing the extension policy. A workstation is not considered fully connected until force-install, enrollment, and event delivery are all confirmed.

Layer 1: Policy applied

Chrome / Edge / Brave:

  1. Open chrome://policy (or edge://policy, brave://policy).
  2. Confirm ExtensionInstallForcelist contains the AgentKeeper entry.
  3. Confirm the managed config keys (orgApiKey, userEmail) appear under the extension's policy section.

If the policy section is missing, the MDM profile has not applied yet. Wait for the next policy sync or trigger a manual sync in your MDM console.

Firefox:

  1. Open about:policies.
  2. Confirm ExtensionSettings contains help@rad.security with installation_mode: force_installed.

Layer 2: Extension installed and paired

Chrome / Edge / Brave:

  1. Open chrome://extensions.
  2. AgentKeeper appears with the badge "Installed by your administrator" and cannot be removed.
  3. Click the AgentKeeper toolbar icon. The popup reads Paired, not "Unpaired" or "Connect".

Firefox:

  1. Open about:addons.
  2. AgentKeeper appears under Extensions with "Installed by your organization".
  3. Extension popup reads Paired.

If the popup reads "Unpaired": the managed config was not delivered correctly. Re-check the orgApiKey value in your MDM policy and confirm there are no JSON formatting errors.

Layer 3: Device appears in AgentKeeper

  1. Open the AgentKeeper dashboard.
  2. Go to Inventory → Workstations.
  3. The managed machine appears with:
    • installMethod: browser_extension
    • The correct user bound (if userEmail was provided in managed config)
    • A green status indicator

If the device does not appear within 5 minutes of enrollment:

  • Check the org API key is correct and has not been revoked (Settings → Access → API keys).
  • Confirm the machine can reach https://www.agentkeeper.dev (outbound HTTPS).

Layer 4: Events flowing

  1. On the managed machine, open claude.ai and send a test prompt.
  2. In the AgentKeeper dashboard, go to Activity.
  3. A new event appears with source browser_extension within seconds.

If no event appears after 60 seconds:

  • Confirm the extension is paired (Layer 2).
  • Open the extension's Options page → Dev mode → check the event log for errors.
  • Check chrome://extensions → AgentKeeper → Service Worker → Inspect for console errors.

Extension ID reference

The extension ID is required when writing MDM policies.

  • Chrome / Edge / Brave / Arc: lllalmnahkbikalapoancgfkiegfoiim (one Chrome Web Store ID shared across all Chromium browsers). To confirm on a device: chrome://extensions → AgentKeeper → Details → Extension ID.
  • Firefox: help@rad.security

Common issues

SymptomLikely causeFix
Extension not appearing in chrome://extensionsPolicy not yet appliedTrigger MDM sync; wait up to 5 min for Chrome to pick up the policy
Popup reads "Unpaired"orgApiKey missing or wrong in managed configVerify the key in your MDM policy; re-push
Device not in Workstations dashboardBackend unreachable or key revokedCheck outbound HTTPS to www.agentkeeper.dev; verify key is active
User not bound to deviceuserEmail not in managed configAdd userEmail with MDM variable substitution and re-push
Wrong user boundEmail variable resolved incorrectlyCheck MDM variable output; device re-enrolls with correct email on next Chrome restart