Administer Glean Tau
Roll out Glean Tau with the models, features, and device access your organization permits. Glean Tau combines permission-aware company knowledge with an agent that can work with local files, commands, and connected apps.
Plan your rollout
Choose the tasks users need to complete before you select a policy. A team that summarizes documents needs different access from a team that builds software or controls desktop apps.
Use these guides to plan the rollout:
| Task | Guide |
|---|---|
| Understand what approvals and sandboxing protect | Glean Tau security and permissions |
| Record access decisions for a security review | Plan a security review |
| Choose a policy source, resolve conflicting settings, and remove policy | Manage Glean Tau settings |
| Write approval, file, network, and feature restrictions | Glean Tau configuration reference |
| Deploy app settings and macOS privacy permissions | Deploy Glean Tau on macOS |
| Deploy Windows machine policy and check its limits | Deploy Glean Tau on Windows |
| Deliver policy through the signed-in Glean account | Deliver server-managed settings |
| Resolve blocked access | Troubleshoot managed settings |
Work with your Glean representative to confirm that the release you distribute supports the selected controls. Managed settings don't grant a Glean license or turn on features that your organization can't use.
Roll out Glean Tau
Test the complete configuration on a small group of standard-user devices before you expand the deployment:
- Select the supported app release and operating systems.
- Configure available models and choose the features users need.
- Deliver device policy before the first launch if agent work must require policy from the start.
- Deploy the app and any required operating-system permissions.
- Ask users to sign in and complete permissions that require their consent.
- Verify a permitted task, a denied task, policy updates, and recovery after a restart.
Test macOS and Windows separately. Windows supports managed settings and a required sandbox, but it doesn't support network confinement and doesn't enforce the managed proxy. See Windows policy support.
For individual installation, see Set up Glean Tau.
Configure models
Glean Tau uses the models your organization enables in the Model Hub. Users choose from the available models for their chats.
Use the existing model administration controls:
The model that answers a chat and the model that reviews an action in Approve for me have separate roles. A managed review-model setting doesn't change the chat model. See Configure automatic review.
Control which extensions users can use
Use a feature allowlist or denylist to control which capabilities can run. Use a managed extension preference to keep an available extension on or off. A feature allowlist permits a feature, but doesn't grant its operating-system permissions, connect an account, or approve every action it performs.
Users can change optional features in Settings → Extensions when policy permits it. A managed preference takes priority over their saved choice. See Control features and Extensions.
Restrict what the agent can do on a user's device
Configure approval modes and sandbox requirements separately. Removing Full access still permits approved commands to run without a sandbox if the policy makes sandboxing optional. Use required sandboxing on supported Macs when a file or process network boundary is mandatory, and allow only features that support that boundary. See Separate approvals from sandboxing.
Start with a configuration example, then test the exact features and workloads you plan to allow. See Choose a policy example.
Monitor usage
Open Admin console → Usage, select the Glean product type, and open Glean Tau. Use the dashboard for your pricing plan:
Usage and cost reports don't prove that a device policy is active. Verify managed values and allowed and denied operations on the device. Handle diagnostic exports as sensitive information because they can include local paths and configuration values.
See also
- Agent approval modes — what users see in each approval mode and how they respond to requests
- Configure your access — how users add project folders and exclude sensitive paths within your policy
- Glean Tau settings — the settings users can change on their own devices