How-to

Share a policy across machines

Goal

Run the same agent on multiple machines, with every machine enforcing the same policy. Changes made on one machine propagate automatically.

The policy file in the quorum location is always encrypted under the swarm-shared ASK — plain-text shared policy is not supported. If your deployments cannot share storage but use the same agent identity, see Export and import a policy instead.

Setup overview

1. Choose a Swarm Key — a strong shared secret all machines will use
2. Choose a quorum location — a path all machines can read and write (network share, EFS, etc.)
3. On each machine, activate the identity, build the local policy, then call EnableSwarmModeAsync with the same Swarm Key and quorum location

First machine — seeds the policy

await policies.AddPolicyRuleAsync(new PolicyRule(
    "*@example.com", "self", "default", "inbound", "allow"));

await client.EnableSwarmModeAsync(
    swarmKey:          "shared-swarm-secret",
    quorumStorageRoot: "/mnt/swarm-share/agents/billing");

// Writes encrypted policy.enc to the quorum location

Additional machines — load the existing policy

// Add at least one rule (required to enter swarm mode)
await policies.AddPolicyRuleAsync(new PolicyRule(
    "placeholder@local", "self", "default", "inbound", "allow"));

await client.EnableSwarmModeAsync(
    swarmKey:          "shared-swarm-secret",   // SAME key
    quorumStorageRoot: "/mnt/swarm-share/agents/billing");

// SDK detects existing policy.enc and loads it
// The placeholder rule is overridden by the shared policy

Mutating the shared policy

On any swarm member, simply add or remove rules as usual. The SDK acquires a distributed lock, writes the new encrypted policy file, and releases the lock. Other members detect the change via their file watcher and reload automatically.

// On any swarm member
await policies.AddPolicyRuleAsync(new PolicyRule(
    "[email protected]", "self", "default", "inbound", "allow"));
// Other swarm members see this rule shortly after