Tags, profiles, and module seats
Assign modules by seat count, bind policy profiles to tags, and tag stations so only licensed endpoints receive each module.
Tags, profiles, and module seats
Trustity Cloud Portal targets module policy by tags. Your commercial package includes a seat count per module. Operators tag stations and edit profiles in Security Policies so only licensed endpoints receive each module.
Model
| Concept | Where | Role |
|---|---|---|
| Seats | Set with your Trustity package (account team / support) | Cap how many stations may receive that module |
| Profiles | Security Policies → Profiles & tags | Named config for a module (Default plus optional Strict / Labs / …) |
| Tags | Overview → Devices & Tags | Labels bound to one profile; members are the stations that get that profile |
| Folders | Devices & Tags (left tree) | Organize stations and bulk-assign tags; not a second policy model |
Flow: confirm seats → bind a tag to a profile → organize stations into folders (optional) → assign the tag to stations or to a whole folder → edit that profile’s settings.
Stations vs users
Seats and tags target stations (enrolled Agent One / machines), not people.
| Layer | What it means |
|---|---|
| Who receives the module | The tagged PC. Example: VisionX on 30 lab machines protects those screens for anyone who signs in there; the same person on an office PC without the tag is not VisionX-monitored. |
| Rule content (profile) | Shared settings for that module profile (keywords, lock mode, thresholds, and so on). |
| FileGuard audience | “Who may open” a labeled file still follows the signed-in user / groups on the station. The FileGuard module must be present on that station via seats/tags. |
| GenGuard in Agent One | Endpoint GenGuard is delivered to tagged stations like other seat-gated modules. The detection rules in the profile can be the same everywhere; only tagged stations run that endpoint module. |
| GenGuard browser extension | Organization license / force-install is separate from station tags. Extension enforcement follows the browser user; it is not the same control as tagging a PC for Agent One GenGuard. |
Roaming (“always protect user X on every PC they use”) is not the current model. Station targeting protects the place where sensitive work happens. Optional user-roaming may be considered later as an add-on, not a replacement for seats on stations.
Seats
- Seats are per module (for example GenGuard 400, VisionX 30).
- When a seat count is set, only stations that carry a tag bound to a profile for that module receive the module. The portal blocks assigning more stations than the seat limit.
- If seats are not set for a module, entitled stations still receive the organization Default profile for that module. New packages should always have seats set.
PAM rotation and Vault file/share limits stay organization-wide. HostGuard IPS participates in tags and profiles like the other seat-gated modules.
To change seat counts, contact your Trustity account team or support — operators do not edit seats in the Cloud Portal.
Profiles
- Open Overview → Security Policies and select a module tab.
- Under Profiles & tags, select the profile you are editing (Editing badge).
- Use New profile for a second configuration (for example Strict).
- Bind to tag… links that profile to exactly one tag.
- Change the form below and save. Default updates the organization baseline and the Default profile together. Named profiles save only that profile’s settings.
Agent One 4.0.3587+ shows assigned tags on the agent Overview.
Devices & Tags workspace
Open Overview → Devices & Tags for day-to-day assignment:
- Create folders (groups) on the left to organize the fleet.
- Create tags on the right (after binding each tag to a profile in Security Policies).
- Select stations in the list and Assign selected, or select a folder and Assign folder to tag every station in that folder (and its subgroups).
- Seat usage appears when seats are configured on your package.
Folders help you browse and bulk-tag. Tags decide which modules each station receives. Folders do not set module policy on their own.
Managed devices (Secure Vault → Devices) still shows fleet health, inventory, and PAM. Use Devices & Tags when the job is organization and seat assignment.
Validation checklist
- Confirm seat counts for each entitled module with your Trustity account team.
- Create or keep Default, optionally add a named profile, and bind each to a tag.
- On Devices & Tags, tag only the stations that should receive the module (or assign a folder); confirm seat usage.
- Save policy on the selected profile; wait for the success message.
- On a tagged Windows station with Agent One 4.0.3587+, Pull now and confirm Overview lists the tag and the module is entitled.
- On an untagged station (when seats are set), confirm that module is absent after policy refresh.