Choose your protected environments
Understand where Orthalon observes, enforces, and discovers AI use across browsers, desktop applications, APIs, networks, and MCP clients.
Use more than one coverage layer when employees and applications reach AI in different ways. Each layer has a distinct job.
| Layer | Observe | Enforce | Important boundary |
|---|---|---|---|
| Browser extension | Supported AI websites and readable uploads | Monitor on all plans; active on Protect+ | Chrome/Edge and a Firefox package; supported adapters and standard file inputs |
| Desktop protection | Compatible native and IDE model traffic | Monitor on all plans; active on Protect+ | The client must support a custom API base URL |
| AI gateway | Server-to-model API traffic | Monitor on all plans; active on Protect+ | The application must send model calls through the gateway |
| Network/directory connectors | AI service inventory | No inline enforcement | Enterprise discovery input |
| MCP agent | Configured MCP servers and explicitly wrapped stdio tools | Allow, deny, approval-hold, and redact on wrapped stdio servers | Enterprise inventory and runtime input |
Business and Enterprise can additionally inspect model responses on compatible desktop and gateway paths.
Recommended coverage by organization
- Browser-first workforce: deploy the browser extension to a pilot group, then expand with managed Chrome or Edge policies.
- Developer workforce: combine the extension with desktop protection for compatible IDEs and MCP discovery on Enterprise.
- Internal AI applications: route approved model API calls through the AI gateway.
- Broad shadow-AI discovery: correlate browser data with Enterprise directory connectors and imported network or CASB records.
Coverage is not the same as enrollment
A configured policy does nothing on a device that has no active sensor or on traffic that does not pass through an enforcement point. Use Security overview and Sensors & keys to verify check-ins, policy versions, and stale devices.
Provision a different expiring key for each environment. Production customers configure browser keys through managed extension policy, desktop and MCP keys through endpoint secret management, and gateway keys through the calling service's server-side secret store. Orthalon hosts the shared ingest and gateway services; endpoint agents remain on customer devices.
Continue with the guide for each environment you plan to deploy.