Skip to content
Get started

Quickstart

Install a Beacon, connect your tenant, and ship your first Lyra policy in a few minutes. Illustrative commands for the Alyria agent-governance platform.

Get from zero to a first policy in monitor mode in three steps: install a Beacon, connect it to your tenant, and apply a first Lyra policy. The commands below are illustrative: the CLI names and flags are indicative of the shipping product and may change.

1. Install a Beacon

Beacon is a signed local daemon for Windows, macOS, and Linux. Install it and verify the signature before it runs:

# Illustrative — install and start the signed endpoint agent
curl -fsSL https://get.alyria.ai/beacon | sh
beacon verify            # checks the binary signature and version
beacon status            # inventory of local AI tooling + CVE posture

beacon status reports the AI CLIs and tools it found, their versions, whether any are down-level, and any known CVE exposure. All of this is read-only: inventory and observation, nothing enforced and nothing intercepted.

2. Connect your tenant

A tenant exposes one MCP endpoint for all of your agents and pulls policy down to each Beacon. Connect with an enrollment token issued from Observatory:

# Illustrative — enroll this endpoint into your tenant's mesh
beacon connect \
  --tenant acme \
  --enroll-token "$ALYRIA_ENROLL_TOKEN" \
  --mcp https://acme.mesh.alyria.ai

The token is single-use and short-lived. Enrollment establishes the Beacon's device identity; no standing credentials are stored on the endpoint.

3. Ship your first policy

Lyra policies are capability-brokered. Start by flagging any MCP tool that has not been explicitly granted, then roll it out to the fleet in monitor mode:

package alyria.lyra

# Deny any tool call that isn't a brokered capability
deny[msg] {
  tool := input.mcp.tool
  not capability.granted[tool]
  msg := sprintf("tool %q is not brokered", [tool])
}

# Illustrative — validate and roll out to enrolled Beacons
beacon policy apply --mode monitor ./deny-ungranted.rego
beacon policy test  --input ./samples/mcp-call.json

In monitor mode, Beacon records what the policy would have decided without blocking anything, locally and deterministically, offline, with no round-trip to the cloud. Decisions stream to Spectra and surface in Observatory. When the data says you are ready, switch the policy to enforce.

Next steps

  • Read the Beacon agent reference for the three enforcement planes.
  • Learn the Lyra policy model and capability brokering.
  • Read about Umbra: agent secrets under your keys, on the roadmap.
← Back to docs