macOS#

The agent uses a persistent P-256 key in the Secure Enclave. The key is non-exportable and signs enrollment, TLS and proof challenges. The broker cannot verify Secure Enclave attestation in this deployment, so macOS devices report key_protection_claimed = hardware_bound while the broker stores key_protection_verified = software. Policy decisions must use the verified value, not the agent's claim. See the protection-level model.

Installation and operation#

The agent runs as a LaunchAgent in the logged-in user's Aqua session. The Secure Enclave key and agent state belong to that user; configuration is machine-wide. Enrollment and proofs therefore require that user's session and do not run before login or from SSH. Configure require_hardware = true to refuse enrollment or renewal if the Secure Enclave key cannot be used; the agent will not silently replace it with a software key.

Each macOS account is a separate NAC device. Enroll one account per Mac: simultaneous logged-in accounts can prove from the same address, which creates an address conflict and withholds grants from both devices. Follow the device installation and enrollment procedure.

The package is a signed, notarized app bundle with an embedded provisioning profile authorizing its application identifier and Keychain Sharing group. The release verifier requires a valid all-device profile. Build and verify the package with packaging/macos/ in exordos_nac_agent.

Key loss and recovery#

Certificate renewal preserves the device key. If the key is erased, lost or no longer available, reset agent state and enroll with a fresh token. The new enrollment receives a new device_uuid; block or delete the old record separately. Copying the agent state to another Mac does not copy the Secure Enclave key. See blocking and key loss.

An operator who verifies enrollment in person can record that fact in an operator-managed device tag and use it in policy. The tag is an administrative assertion; it is not Secure Enclave evidence. The procedure is in deployment.