
exordos-nac-agent installed. It is not running yet, and cannot be: this machine
has no device identity.

  One command left. Join, with the ticket an operator issued you - one string
  carrying the broker's address, the fingerprint of the certificate that broker
  must present, and a one-time token. Read it from stdin so a live credential is
  not left in the shell history:

    exordos-nac-agent join --require-hardware --ticket -

  That writes /etc/exordos-nac-agent/config.json and the pinned CA beside it,
  enrols this machine, and then enables and starts exordos-nac-agent-prove -
  which is not optional: a grant is a fifteen-minute lease, so a device that
  proves once and stops is back in quarantine and cannot leave, because leaving
  requires proving. `--require-hardware` refuses to continue with a copyable key
  rather than quietly settling for one, and `--start=false` leaves the unit
  stopped for a deployment that starts it some other way.

  It also says whether this machine can install a release it is offered. An agent
  installed from a release carries the key that decides it; one built without
  says so there.

  Without a ticket - an operator who hands out a bare token - the halves are
  separate: `exordos-nac-agent configure --broker https://broker.example
  --ca /etc/exordos-nac-agent/broker-ca.crt` writes the same file (it merges,
  so naming one field does not drop another), then `exordos-nac-agent enroll
  --start --token -`.

  On a gateway, `exordos-nac-agent-enforce` instead - see
  https://github.com/exordos/exordos_nac/blob/master/docs/deploy.md

