Skip to main content
Verify a pilot device before expanding the rollout. A connected tray state is necessary, but the final check is a supported AI request reaching Bifrost with the intended user and policy.

​
1. Sign in

Open the Bifrost Edge tray or menu-bar icon and select Sign in. Edge opens the Bifrost login page in the default browser. Complete your organization’s SSO flow. When authorization succeeds, the browser hands the session back to the local Edge agent and the tray shows the signed-in user and Connected. If the tray reports User provisioning not set up - contact your Bifrost admin, the identity provider is not configured yet. Complete Prepare identity and access and sign in again.
Connected Bifrost Edge menu showing budget usage, top models, top applications, and account, diagnostics, and support controls

​
2. Complete certificate trust

On a direct macOS installation, approve the Bifrost certificate when prompted and complete the administrator authorization. A managed macOS device should already trust the CA through its device-scoped profile. Windows and Linux establish trust from the elevated agent. Until the certificate is trusted, Edge passes traffic through without inspecting it.

​
3. Restart the computer

Restart the computer after the Edge certificate is trusted. The restart is required for the certificate change to take effect. If the certificate is replaced later, restart again after the device trusts the replacement. Do not continue to traffic verification until the computer has restarted.

​
4. Run Diagnostics

Open Diagnostics from the Edge tray. The Overview should show a Healthy badge, with green status indicators for the checks shown below.
Bifrost Edge Diagnostics overview showing a Healthy status and green indicators for service, account, configuration, certificate, traffic capture, MCP, and gateway checks
Confirm the following groups have no unresolved failures: If a check is not green, select it to review its details before continuing. If Diagnostics offers Approve certificate, complete that action before testing traffic. After making a trust change and restarting the computer, use Refresh certificate status to confirm the updated state.
A healthy Diagnostics overview confirms the agent’s current checks, but it does not replace the test request later in this guide.

​
5. Confirm the device in Bifrost

Go to Edge Control → Devices. Find the pilot device and confirm:
  • The owner matches the signed-in user.
  • The hostname, platform, architecture, and agent version are correct.
  • The device is online.
  • The expected installed AI applications and MCP servers appear after inventory sync.
Edge Devices page showing enrolled devices

​
6. Send a test request

  1. After the computer restarts, open the test AI application.
  2. Use an application listed in Supported applications.
  3. Send a small test request.
  4. Confirm the request is visible in Bifrost logs, attributed to the signed-in user and their governed virtual key.
  5. Confirm the request receives the access-profile, budget, rate-limit, and guardrail behavior expected for that identity.
Only configured and supported AI domains are intercepted. Unrelated device traffic is not routed through Edge.

​
7. Verify an approval change

If the test application or one of its MCP servers appears under Edge Control → Approvals, set the intended approval status. Wait for the next agent poll, then confirm the device enforces the new state. Pending behavior depends on Allow pending apps and MCP servers in Edge Settings. A pending item works when that setting is enabled and is blocked when it is disabled.

​
Edge verification

Verification is complete when the computer has restarted after the CA trust change, Diagnostics is healthy, the device is online, a supported request appears in Bifrost, and the intended policy is applied. If any checkpoint fails, use Troubleshooting Edge setup.