Your first approval on one laptop

Hold your agent's command on your laptop until you approve it.

On this page

You use the standalone profile, so Straza runs on your laptop and signs you in itself, with no external identity provider. How it works explains the model, and Try it on one laptop walks through all of these steps.

1. Get the binariesTutorialPut strazad, strazactl and straza on your PATH, on a machine with no Straza package or managed install.
2. Start the serverTutorialRun strazad on the standalone profile. Its first start prints the admin password and adds a starter rule that denies a recursive forced delete.
3. Sign in to the consoleTutorialSign in as the admin from the first start, and mint a token for strazactl.
4. Add alice, the person your agent works forTutorialAdd the person your machine enrolls as, with the role that lets their browser approve.
5. Enroll your machineTutorialStart the Straza service and run straza enroll, which signs you in.
6. Connect Claude CodeTutorialstraza install claude-code installs the hook for your user, and the starter rule then denies a command.
7. Hold a command for yourselfTutorialA rule with the mode confirm holds a command until you approve it.
8. Turn on approvals in this browserTutorialOn the self-service page, under This browser.
9. Approve your agent's callTutorialStraza denies the agent’s call at once with a reference. Approve it on the self-service page under Requests. An identical retry in the same session within 60 seconds of your approval runs once.
10. Remove Straza from this machineTutorialRemove the hooks while the service still runs, then stop the service and the server and delete their state.
11. What this protects on one laptopTutorialIt catches a mistake by the agent or a prompt injection against it. It does not stop you, because you approve the calls yourself. A hook installed for your user is also advisory.

NextSet up Straza for a team→